Modern construction software rarely works alone. The project platform connects to accounting. The scheduling tool pulls from the document system. A photo app has access to Microsoft 365 accounts. A bidding service links to email. Each connection is useful, and each one is also a path that carries data and credentials outside the original platform.
Over a few years, a contractor can accumulate dozens of integrations, many set up by people who have since moved on. This post explains how to review them and put reasonable controls in place.
Why integrations create risk
- Excess permissions. Apps often request broad access, such as reading all files or all email, when they need much less.
- Persistent access. Many integrations use tokens that stay valid for months or years, even if the person who approved them has left.
- Unknown vendors. An app installed by a project engineer may come from a small company whose security practices nobody reviewed.
- Chain of exposure. If the third party is compromised, the attacker may use the existing connection to reach your data.
- Shadow IT. Integrations created without IT knowledge cannot be inventoried or monitored.
Step 1: Build an inventory
List every integration across your main platforms: project management, accounting, Microsoft 365, file sharing, scheduling, estimating, safety, telematics and time tracking. For each, record:
- The app and vendor name
- The business purpose and owner
- Which systems it connects to
- What data and permissions it holds
- Who authorized it and when
- How it authenticates, for example an API key, token or service account
Most platforms provide an administrator page showing connected apps and authorized tokens. Microsoft 365 offers a view of application consent. Start there.
Step 2: Remove what is unused
Ask each owner whether the integration is still needed. If nobody claims it, or the answer is vague, plan to disable it after notice. Revoking access to unused apps is one of the cheapest ways to shrink exposure.
Step 3: Check permissions against need
For the integrations that remain, look at the scopes requested. Can they be narrowed to a single project, folder or function? Does the app need write access, or would read-only do? Replace broad personal tokens with dedicated service accounts that have limited rights, and avoid using an individual employee's credentials for integrations. When that person leaves, the connection breaks, or worse, it keeps working under a disabled identity.
Step 4: Control future approvals
Set a rule so that new integrations require review. In Microsoft 365, administrators can restrict who can approve app access, and send requests to a reviewer. In other platforms, limit who holds administrator rights to install marketplace apps.
A simple intake form can ask:
- What problem does this solve?
- What data will it access?
- Who is the vendor, and where is their security documentation?
- What happens to our data if we stop using it?
- Who will own the integration?
Step 5: Review the vendor
For anything that touches sensitive data, check basic facts:
- Does the vendor publish security information or independent assurance reports?
- Do they support multifactor authentication and single sign-on?
- How do they notify customers of incidents?
- Where is data stored, and can it be deleted on request?
- Does the contract address data ownership and confidentiality?
You do not need a deep audit for every app. Match effort to sensitivity.
Step 6: Protect credentials
API keys and tokens should live in a secrets manager or in the platform's protected settings, not in spreadsheets, shared drives or email. Rotate them on a schedule and whenever personnel changes. Where the system supports it, restrict keys to specific IP addresses or functions.
Step 7: Monitor and review
Turn on logging for application consent and integration activity. Review new integrations monthly, and perform a full inventory review at least annually. When a vendor announces a security incident, you should be able to answer quickly whether you use them and what they can reach.
Special attention for regulated work
If you handle CUI or sensitive energy infrastructure information, integrations that move that data fall within your scope. Anything that processes it must meet your compliance obligations, so confirm with your compliance lead before approving them.
Offboarding apps
When you retire a tool, revoke its access, delete its tokens, export what you need, request deletion of your data and update your inventory. Many companies cancel the subscription but leave the connection alive.
How Ironfield Cyber helps
Ironfield Cyber helps contractors and energy companies inventory and govern the apps connected to their project, accounting and Microsoft 365 systems. If you are not sure what has access to your data, we can help you find out.