Revocation hygiene is the practice of regularly removing application access, OAuth grants, API keys, and tokens that are no longer needed. In cloud and SaaS environments, permissions often persist after a project ends, a vendor changes, or an integration is replaced. If those credentials stay active, they become standing trust relationships that an attacker can abuse.
This matters because compromised or forgotten third-party apps can still read mail, files, or identity data long after the business need has passed. Good revocation hygiene means reviewing connected apps, disabling unused integrations, expiring tokens, and checking that access matches current scope. Defenders use admin consoles, audit logs, and periodic access reviews to find stale grants, while attackers often look for them as low-friction entry points that bypass password protections and MFA. Regular revocation reduces authorization debt and limits the blast radius of a compromise.