Short answer: Level 1 counts every app, script and service that acts for your people, not only the people themselves.
- A list: every app, integration and service account that can reach company data, with what it does and who is responsible for it.
- Its own identity: each one signs in as itself, never with a person's login.
- Limited access: only the ones you approved can get in, and new apps cannot gain access without an administrator's approval.
What the rule asks
Two practices cover apps and processes, with three checks between them:
| Practice | The assessor checks that… |
|---|---|
| AC.L1-b.1.i | the apps and processes acting for your people are identified |
| AC.L1-b.1.i | access is limited to those approved apps and processes |
| IA.L1-b.1.v | each process acting for a user is identified |
What counts
- Apps connected to Microsoft 365 or Google Workspace, such as a CRM, an e-signature tool or a backup service.
- Service accounts used by a scanner, a backup tool or an accounting integration.
- Scripts and automations that sign in to company systems.
What good looks like
- One list of apps and service accounts, each with what it does, how it signs in and the person responsible for it.
- Nothing on the list signs in with an employee's login.
- Apps that no one uses are switched off.
How to do it in Microsoft 365
- See what can act in your organization. In Microsoft Entra (entra.microsoft.com), go to Identity → Applications → Enterprise applications → All applications. The list shows the apps and service identities that can act in your Microsoft 365.
- Record each one. Note its name, what it does, and the person responsible for it.
- Review permissions. Open each app's Permissions, and remove apps or permissions you do not recognize.
- Require approval for new apps. Under Enterprise applications → Consent and permissions, limit user consent so a new app cannot gain access without an administrator's approval.
- Switch off what is unused. Disable apps and service accounts that no longer have a purpose.
In Google Workspace, connected apps are in the Admin console under Security → Access and data control → API controls, where you can block apps you have not approved.
What proof to keep
- The list of apps and service accounts, with what each does, how it signs in and who is responsible for it.
- A screenshot of your user consent setting.
- The date of your last review.
Common mistakes
- An app someone connected years ago that can still read every mailbox.
- A scanner or backup tool that signs in with an employee's account.
- A service account left active after the tool it served was retired.
Do it step by step
The App and service accounts task in ReComply keeps this list with you: type each one in, or upload the list you already have. It is one of the three tasks open on the Free plan.
Start free