How to Review and Revoke App Access and Sessions

The Problem

Most people believe changing a password ends unauthorised access. Often it does not.

Two things survive a password change:

Active sessions. Once signed in, a browser or app holds a session token. Some services invalidate those on password change; several do not, or only do so partially. An attacker who is already signed in stays signed in.
Connected apps and app passwords. Anything you granted access with "Sign in with Google" or an OAuth prompt keeps its own token. So does any legacy "app password" you created for a mail client. Those are independent of your password entirely.

That is why account compromises appear to come back. The password is new, but the door someone else propped open is still there.

This audit takes about twenty minutes across your main accounts and should be done after any incident — and once a year regardless.

Doing this because something happened? Do it in the right order: change the password first, then revoke sessions, then remove connected apps. Revoking first just gets undone by a session that is still live.

The Fix: Step-by-Step

Step 1: Microsoft Account

Go to account.microsoft.com → Security.

Advanced security options → Sign me out — ends every session on every device.
Ways to prove who you are — delete any email, phone, or authenticator you do not recognise.
App passwords — under advanced security options, delete all of them and recreate only what you still need.
Back on the main account page → Devices — remove devices you no longer own. Save any BitLocker recovery keys shown for those devices first, because removing the device deletes the key.
Privacy → Apps and services that can access your data — revoke anything unfamiliar.
Sign-in activity — review for locations and app types you cannot account for.

If anything here looks wrong, go to recover a hacked Microsoft account.

Step 2: Google Account

Go to myaccount.google.com → Security.

Your devices → Manage all devices — sign out of anything you do not recognise or no longer use.
Your connections to third-party apps and services — this is the important one. Review every entry and check what it can do; "See, edit, download and permanently delete all your email" on an app you tried once is exactly what to remove.
App passwords (visible only if 2-Step Verification is on) — revoke all and recreate as needed.
Recent security activity — check for sign-ins and permission grants you did not make.
How you sign in to Google — confirm recovery phone and email are yours.

Gmail specifically: Settings → See all settings → Forwarding and POP/IMAP for forwarding addresses, and Filters and Blocked Addresses for rules that delete or forward mail. Attackers leave these behind routinely.

Step 3: Apple ID

On appleid.apple.com or on your device in Settings → your name:

Review the Devices list and remove any you do not own.
Sign-In and Security → Sign in with Apple — review apps using your Apple ID and stop using any you do not recognise.
Check Account Security → trusted phone numbers.

Step 4: Facebook, Instagram, and Other Social Accounts

These matter because "log in with Facebook" grants sit here, and because a compromised social account is used to scam your contacts.

Facebook: Settings & privacy → Password and security → Where you're logged in, and Apps and websites.
Instagram: Settings → Security → Login activity, and Apps and websites.
X / Twitter: Settings → Security and account access → Apps and sessions → Connected apps.
LinkedIn: Settings → Sign in & security → Where you're signed in, and Permitted services.

More on locking these down: protect your privacy on social media.

Step 5: Your Password Manager

This is the highest-value account you own, and people forget to audit it.

Check the manager's own security page for active sessions and authorised devices, remove any you do not recognise, and confirm 2FA is enabled on the manager itself. If in any doubt, change the master password and re-verify every device.

See use a password manager safely.

Step 6: Windows Sign-In and Remote Access

On the PC, check the local equivalents:

Settings → Accounts → Other users — remove accounts you did not create.
Settings → System → Remote Desktop — off unless you need it, and hardened if you do: secure Remote Desktop.
Win + R → control /name Microsoft.CredentialManager — remove saved credentials for machines and services you no longer use.
Windows Security → Firewall → Allow an app through firewall — untick anything remote-access related you did not install.

Step 7: Judge Each Connected App on Two Questions

When reviewing a list of connected apps, ask:

Do I still use it? If not, remove it. Unused grants are pure risk.
Does the permission match the purpose? A photo-printing service needing to read your email is not a permission mismatch, it is a warning.

Removing a grant does not delete your account with that service — you can reconnect later if you were wrong.

Step 8: Re-Check After 24 Hours

Come back the next day and look at each sessions list again. Anything that has reappeared means either a device of yours signed back in automatically, or someone still has working credentials. In the second case, the PC itself is likely compromised — run remove virus and malware and remove malicious browser extensions.

Step 9: Make It Harder Next Time

Add passkeys so there is no reusable credential to steal.
Enable two-factor authentication everywhere, app-based rather than SMS.
Stop using "Sign in with Google/Facebook" for services you do not trust — a separate password in your manager grants nothing beyond that one service.
Diary a yearly re-audit.

What Actually Ends Access

| Action | Ends browser sessions | Ends connected apps | Ends app passwords | |---|---|---|---| | Change password | Sometimes | No | No | | Sign out everywhere | Yes | No | No | | Revoke app access | No | Yes | No | | Delete app passwords | No | No | Yes |

You need all four after a compromise. That table is the whole reason this guide exists.

What Not to Do

Do not revoke before changing the password. Someone with the old password just signs back in.
Do not remove Microsoft devices before saving BitLocker keys — the keys go with them.
Do not blindly revoke everything on a work account. Some grants are your employer's management tooling; ask IT.
Do not assume an unfamiliar location means an intruder. Mobile networks and VPNs routinely report a city hundreds of miles away. Judge on device and app type as well as location.

FAQ

Does changing my password sign everyone out?

It depends on the service. Google and Microsoft end most sessions but not connected-app tokens or app passwords. Some smaller services end nothing at all. Always use the explicit "sign out everywhere" control in addition to changing the password.

What is an app password and why is it risky?

It is a separate long password generated for software that cannot handle modern sign-in — older mail clients, for example. It bypasses two-factor authentication by design, and it survives password changes. If you have any you do not actively need, delete them.

Should I remove "Sign in with Google" connections?

Remove the ones you no longer use. For services you actively use, it is often safer than a separate password because there is no extra credential to breach — provided your Google account itself is well protected with 2FA or a passkey.

An unfamiliar city is showing in my sign-in list. Have I been hacked?

Not necessarily. Mobile carriers route traffic through regional gateways, and VPNs report the exit location. Look for a device type or app you do not own, or a sign-in at a time you were definitely not using the account — those are stronger signals than location alone.

How often should I do this audit?

Once a year for maintenance, and immediately after any suspected compromise, phishing click, lost device, or breach notification.

I revoked an app and now something stopped working. Can I undo it?

Yes. Sign in to that service again and re-approve the connection. Revoking a grant does not delete data or close accounts — it just requires a fresh authorisation.

Still Not Working?

If sessions or forwarding rules keep reappearing after a full pass, the credentials are still being taken — usually by malware on the PC or a malicious browser extension. Clean the machine first with remove virus and malware and remove malicious scheduled tasks and startup persistence, then repeat this audit from a device you know is clean.