Body
At this time, Adobe products will not be included in this change. They will continue to function normally. With these changes, ITS seeks to limit unsupported and unapproved integration with our data. Adobe products should be purchased through approved University channels. But due to their heavy usage, we will not be revoking Adobe product access during J-Term. Some Adobe integrations and products may be restricted and removed later in 2026. However, all University faculty, staff, and students will be able to continue reading and saving PDFs. Editing and signing PDFs will continue to work for those with approved University licenses for those features.
Overview
We are strengthening the university’s cybersecurity posture and aligning with evolving federal standards by taking a stricter approach to third-party OAuth applications being used by St. Thomas community members with their accounts.
What are Third-Party OAuth Apps?
OAuth (Open Authorization) apps allow users to grant external applications limited access to their university accounts, such as email, calendars, or files, without sharing passwords. While convenient, these apps can pose significant risks if not properly vetted and closely managed. Examples include:
- Edison Mail - unlicensed 3rd party email client
- Calendly - free, unlicensed calendar/scheduling app
- Todoist - unlicensed to-do list / task list tool
- Reclaim.ai - unlicensed AI-powered calendar assistant
Why is this change necessary?
Third-party apps can introduce vulnerabilities such as unauthorized data access, data leakage, and exposure to phishing or malware. Several recent breaches in higher education have been traced to insecure or misconfigured third-party integrations, and there have been class action lawsuits about at least one popular AI meeting attendant app called Otter.ai that we explicitly blocked earlier this summer.
A compromise via an insecure app could result in the loss of sensitive information, regulatory penalties, and reputational harm to the university. Unvetted third party applications have been permitted to interact with university accounts with little to no oversight. The proliferation of tools increases university risks, and the number of vendors we need to trust and support with our limited resources.
What access will be removed?
Initially, any application that is unverified by Microsoft and lacks a university contract will not be allowed to use university accounts. A detailed list of these applications can be found here.
If you are using an application on this list for a critical business or academic need, you can enter a ticket with the Tech Desk and we can review your request. Exceptions are not automatically granted and are assessed on a case by case basis. Requests for exemption will likely need to follow the to ensure that we meet our internal standards and select the right tools. You may also contact your BRM to start the conversation.
What do I need to do?
Prior to January 13th, 2026 you will need to migrate any data stored in an unauthorized application to university supported storage.