Overview 

To protect your and Northwestern’s data, access from third‑party services to Microsoft 365 (email, calendar, files, Teams, etc.) is now more restricted. Individuals can no longer independently authorize new third‑party apps. Applications must be evaluated and receive Northwestern administrative approval first before anyone can connect them to their account.

Since these apps access your information and Northwestern’s services as if they were you, they have the potential to be very helpful, but could also could cause harm if they were malicious or flawed.  This change is designed to reduce the risk of unauthorized data exposure through legitimate apps that do not protect your data or through consent‑phishing (Microsoft's overview), where an application appears legitimate but tricks users into granting broad data access and then acts without their credentials. 

What Changed 

Previously, signing in to a third‑party app was often enough to grant it access to your Microsoft 365 data. Now, two approvals are required:

1. Institutional approval of the service (University‑wide), based on need, security, and contractual evaluations
2. Your approval to allow the app to access your account 

If the application has not been approved at the university level, you will not be able to authorize it. 

What This Means for You 

Many third party apps will not be eligible for approval.  Approval cannot be granted for a single individual or small group—it applies across all of Northwestern. Northwestern prioritizes evaluating and approving apps that are:

• Needed broadly across the community
• Not already available through approved, contracted services 

How to Request a Third Party Service be Evaluated for Approval 

If you attempted to connect a third‑party service and were prompted to submit a request, that request is routed to the appropriate Northwestern IT teams for review. 

Only applications that complete security, privacy, and contractual review and align with institutional needs may receive approval. Approval is not guaranteed. 

There are thousands of services – each claiming to be uniquely useful - but Northwestern can’t evaluate all of them. The goal is to point people to approved contracted services providing similar features which they can use immediately and to prioritize evaluations and contracts for services that provide features across the community that are not already in place.

Kellogg users must complete the Request for New Service form and provide the following details for the request to be reviewed:  

• What the service does
• Which approved alternatives you evaluated and why they do not meet your needs
• Security documentation from the vendor