Two kinds of permission
When people talk about app permissions, they usually mean one of two things, and it helps to keep them apart.
Device permissions control what an app on your phone, tablet or computer can use: the camera, microphone, location, contacts, photos, files, notifications, Bluetooth or the ability to run in the background.
Account access controls what a connected app or add-on can do with data in an online account. When you use a button such as “sign in with” another service, or connect a calendar tool to your email, you are typically granting that app a defined set of rights over your account. It often continues to have them until you remove it, even if you no longer use the app.
Both matter. The first affects what is on your device, and the second affects what lives in your work accounts.
Why permissions are worth a look
Most apps ask for access in order to do their job. A maps tool wants your location, a video-call tool wants your camera. The trouble starts when:
- An app asks for more than its function needs.
- You granted access long ago and forgot.
- An app is abandoned, sold or has a security problem, and its stored access becomes a path into your data.
- A fake or poorly built app is installed on purpose or by accident.
The more an app can see, the more could be exposed if something goes wrong with it. Reducing access reduces that exposure, in the same way that giving someone view-only rights is safer than giving them edit rights.
How to judge a request
When an app asks for something, ask three questions.
- Does this match what the app does? A flashlight tool that wants your contacts does not add up. A scanner app that wants camera access does.
- Does it need this all the time? Many systems let you grant access only while using the app, or only once.
- How much does it want? “Read” is narrower than “read and change,” and access to one folder is narrower than access to everything.
If the answers are unclear, say no first. You can almost always grant it later if a feature genuinely needs it.
Reviewing permissions on a device
Phones and computers have a settings area that lists permissions either by app or by type. Look for the section on privacy or app permissions, and then:
- Check which apps can use location, and switch most to “while using” or “never.”
- Look at microphone and camera access, and remove it from anything that has no reason to use it.
- Review access to contacts, photos and files.
- Check which apps can send notifications or run in the background; trimming those also helps with notification overload.
- Delete apps you no longer use. An unused app with broad permissions is all risk and no benefit.
Menus and wording differ between systems, so look in the settings search rather than expecting an exact path.
Reviewing access to online accounts
Most major account providers have a security page listing third-party apps and sites that have been granted access. Look for wording such as “connected apps,” “authorized apps,” “third-party access” or “linked accounts.”
For each entry, ask:
- Do I still use this?
- Do I recognize it?
- What is it allowed to do? Reading email and sending email are very different.
- Was it connected by me, or by someone else on my team?
Remove what you do not need. Removing access does not usually delete your data from the app; it just stops the app from reaching your account. If you rely on the app, you can reconnect later with narrower access.
Extra care is worthwhile for browser extensions, which can sometimes read or change the pages you visit. Install only those you need, from a trustworthy source, and review them from time to time.
At the team level
In a workplace, the people who administer your accounts can often control which apps employees may connect, and can see which are in use. Useful practices include:
- Keeping a short list of approved apps, which helps limit tool sprawl.
- Requiring approval before anyone connects a new tool to company email or storage.
- Reviewing connected apps periodically and removing those no longer used.
- Checking what happens to connections when someone leaves, as part of access offboarding.
Automations and app integrations deserve the same scrutiny, since each connection hands one tool a key to another. Before connecting, check what the integration will read and whether you can limit it. The privacy policy for the tool will usually explain what the company does with the data it receives.
Be careful with consent prompts
Attackers sometimes create apps that look legitimate and send a message asking you to “authorize” them. Granting access through such a prompt can give them the same reach as stealing a password, without ever asking for it. If a permission request arrives unexpectedly, do not approve it. This is a form of the deception covered under phishing, and a second login step does not necessarily protect you, since you are the one approving.
A quick routine
- Every few months, open the permission settings on your phone and computer and trim.
- Do the same for the connected apps in your email, storage and calendar accounts.
- Say no or “only while using” by default for new requests.
- Remove apps and extensions you have not used lately.
Doing this occasionally takes only a few minutes and keeps old access from accumulating.