How do I identify the publisher of a third-party integration?

Most of the time, the publisher of a third-party integration will be obvious when looking at the Third-party integrations page in the Push admin console.

Third-party integration list - KB 10077

However, some software providers may not have planned for integration names or details to be visible in a tool like Push, and you may occasionally see a generic integration name like “User Login.”

Generic integration example - KB 10077

In these cases, you can click on the integration to get more details, including the reply URLs, which will provide more information about the domain of the publisher.

Generic integration details pane - KB 10077

Note that if an integration has more than one reply URL, you should examine each one carefully.

Some publishers may use multiple reply URLs for legitimate purposes, such as testing. However, these callback domains are not verified by Microsoft or Google, and only one domain needs to be owned by the publisher, so nefarious publishers may use multiple domains to try to appear legitimate — a recognizable one and one they actually own and use as the callback domain.

If after investigating further, you do not recognize or trust the integration, you can remove it.