Stop Shadow SaaS in 2 Clicks: Lock Down Third-Party OAuth in Google Workspace

Every 'Sign in with Google' click on a random SaaS grants scopes to your corp Drive and Gmail. One admin setting blocks them all by default and makes you whitelist the apps you actually trust. Here's how it works, what breaks, and how to roll it out.