Grammarly

1. 01
   1 person authorized Grammarly against their Google account with scopes that expose files. Review it under Google Workspace API controls and mark it trusted, limited, or blocked; blocked revokes existing tokens.

   Identity
2. 02
   Scopes expose files. Evaluate the vendor's retention and training terms before allowing continued use.

   Identity
3. 03
   Grammarly was connected by users, not assigned by an admin. If it is approved, add it to the Workspace app catalog so access is managed and can be revoked at offboarding.

   Identity
4. 04
   Nobody signed into Grammarly through Google in 90 days. Unassign or revoke to reduce standing access.

   Identity
5. 05
   Grammarly runs as a browser extension on 3 devices and can read every page those users open, including webmail and internal apps. Manage it with the browser's ExtensionInstallBlocklist or allowlist policy.

   Endpoint
6. 06
   Grammarly was seen only on endpoints, not in Entra or network discovery, so it may be used offline or from unmanaged networks. Check the device list for VPN gaps.

   Endpoint

Trains on data

No

Enterprise tier

Available

Org policy

None set

Reads every text field it is enabled in, including email and documents.

• Identity · Google Workspace (demo)●Medium45
• Endpoint●Medium45

Each lane scores its own evidence. The combined score takes the strongest lane and adds five points per additional lane, capped at 100.