Overview
By default, any OAuth app can request access to Gmail on behalf of your users. Restricting Gmail's API access ensures only explicitly approved email clients can connect to Google Workspace, blocking unauthorized third-party apps even if a user attempts to grant them access.
Prerequisites
Super Admin access to the Google Admin console
Instructions
Sign in to the Google Admin console
Navigate to Security > Access and data control > API controls
Click Manage Google Services
Locate Gmail in the list and click on it
Set access to Restricted
Click Save
Once Gmail is restricted, only apps you have explicitly marked as trusted can access it.
To approve a specific email client:
In API controls, click Manage third-party app access
Click Add app and search for the app by name or OAuth client ID
Set the app's access to Trusted
Click Save
⚠️ Once Gmail is set to Restricted, any app not explicitly marked as Trusted will lose access to Gmail for your users. Make sure all approved email clients are added as trusted apps before enabling this setting to avoid disrupting access.
Note: This setting works best alongside Block Outdated Email Methods to ensure legacy POP and IMAP access is also disabled, and Restrict App Access to prevent users from accessing any unconfigured third-party apps.