Locking Down OAuth App Access in our Salesforce Org

Question

I am looking to control Salesforce OAuth Application Access so it requires admin approval prior to being connected.

Current Issue

All employees at our organization have OAuth Access to Salesforce.

They are connecting to many apps such as WorkBench, Gong.io, & so on...

We want to block all employees from connecting to Salesforce via OAuth without Admin Approval.

For example with an app such as WorkBench -

1. We only want Admins to authorize Workbench to work with our Salesforce Org.

2. We then only want Admins to authorize the specific users that can use Workbench in our org.

Also, why are there apps in the "Connected Apps OAuth Usage" page that are not on the "Manage Connected Apps" page?

Overall, I am trying to understand:

1. How we can control what apps have OAuth access to our org
2. How we can control the specific users that have access to those apps.

Answer 1

I belive you are looking for API client whitelisting. You can get it enabled by raising a case with Saleforce.

Please do verify how it impacts the current connected apps before enabling it.

You can use API Access Control to restrict users from accessing your Salesforce APIs, unless they're pre-authorized through an approved connected app. Connected apps integrate external applications with Salesforce APIs. With API Access Control, you can lock down all connected apps’ access to Salesforce APIs, and then approve (allowlist) specific connected apps. Using profiles and permission sets, you can then grant users access to an approved connected app. These users can access APIs through the connected app.

https://help.salesforce.com/articleView?id=sf.security_api_access_control_all_users.htm&type=5&sfdcIFrameOrigin=null