Shopify said on November 5, 2026 that merchants can review more connected-app access and security information from Settings > Apps. The app list now shows recent activity and flags security issues; app detail pages bring permissions, access and activity together and identify permissions that may involve sensitive data. For a brand with multiple agencies, feeds and fulfillment apps, this is a good time to assign an owner to the app inventory.
What the new view shows
Shopify's changelog says merchants can also see whether an app has adopted required measures including expiring access tokens and enforced IP restrictions. These indicators are useful review inputs, not a complete security certification. A missing indicator needs investigation with the app owner or vendor before the team decides what to change.
Review business need and data scope together
Start with apps that touch orders, customers, payments or catalog data, then compare each app's permissions and latest activity with its current business purpose. Identify the employee or partner accountable for it. If a campaign tool is no longer used, verify dependencies before removal: disabling an app without checking active automations, feeds or checkout behavior can interrupt sales operations.
This is Etail Rocket's operating recommendation. Shopify's announcement establishes what the admin now displays; it does not say the screen automatically fixes access risks or that every app with sensitive-data permissions is inappropriate.
A practical review cadence
- Open Settings > Apps and inventory connected apps, owner, purpose and recent activity.
- Review permissions and security indicators on each high-access app's detail page.
- Ask the responsible vendor or team to explain any broad permission or inactive integration.
- Document approved changes, test the affected workflow, and revisit access after holiday campaigns.
For a broader commerce operations review, talk with Etail Rocket.