You can use app access settings to control which apps members of your Enterprise account can use in Zap workflows and Agents. Enterprise accounts created on or after October 5, 2026 use the allowed apps setting: members can only use apps that an admin has added to your allowed list, and admins can prohibit specific triggers and actions within an allowed app.
By the end of this article, you'll understand how allowed apps work, how to plan your allowed list, and how the legacy restricted apps setting differs if your account still uses it.
Available on plans:
Free
Professional
Team
Enterprise
NoteApp access controls are changing. Over the coming months, Zapier is replacing the choice between allowed apps and restricted apps with a single Apps page where you sort apps into control levels, manage them in bulk, and set a safe default for anything you have not reviewed.
To request early access to the new experience on your Enterprise account, submit an Enterprise feature request and select Advanced enterprise app controls.
How allowed apps work
With allowed apps, app access is closed except where you've allowed it. Members can only use apps on your allowed list.
You can:
- Add allowed apps.
- Prohibit specific triggers and actions in an allowed app.
- Add member or team exceptions.
Members will not be able to publish any new or edited Zap that includes an app that is not allowed, and Agents that use an app that is not allowed may not run as expected. They will see a notification that the app is prohibited. If an existing Zap includes a prohibited app, it will remain on but steps that use the prohibited app will be held when the Zap runs. When a member views the Zap run details, they will see a notification on the step run indicating that the step was held. They will not be able to replay the step as long as the app is prohibited.
A new Enterprise account starts with an empty allowed list, so members cannot use any apps until an admin adds them. Add your allowed apps before your team starts building.
Why manage app access?
App usage in Zapier is driven by your day-to-day business processes (like "quote to cash" or "lead routing") which remain relatively consistent. However, the tools you use to perform these steps evolve as your company's tech stack changes.
Allowing apps explicitly helps you:
- Ensure only vetted or official tools are used across your organization.
- Meet strict compliance and security requirements (for example, in financial services or healthcare).
- Give admins full visibility and control over which apps are used in your account.
- Keep tools consistent across teams.
The tradeoff is that adopting a new tool requires an admin to allow it first. You can reduce that friction by planning your allowed list well and by using member or team exceptions for teams that need specialized apps.
Plan your allowed apps list
Planning how your team will access and use apps through Zapier is crucial to scaling your automation strategy. Follow these steps to build an allowed list that works from day one:
1. Start with the apps your team already uses
Review your Apps page to check which apps are connected and used in Zap workflows and Agents across your account. Every app in active use belongs on your allowed list.
2. Allow whole suites, not single apps
If your organization runs on Google Workspace or Microsoft 365, allow the full suite rather than individual apps. Members will need the pieces you leave out.
3. Include Zapier's built-in tools
Built-in tools such as Formatter, Filter, Paths, Delay, Webhooks, and Code by Zapier do not require credentials and are used in most Zap workflows. Allow them so your team can build complete workflows. Consider whether Webhooks, Code, and API Request by Zapier fit your security posture, since they can reach any API.
4. Decide category by category
Make an explicit decision for each category of tool: productivity, email and calendar, chat, task management, file storage, CRM, HR, finance, data, and AI. Leaving an app off the list is a decision too. Log the apps you've deferred so you can revisit them.
5. Add action restrictions where they matter most
Within an allowed app, you can prohibit specific triggers and actions. Common starting points:
- Block delete actions on systems of record such as your CRM, ERP, HRIS, or ticketing tool.
- Block API Request actions unless a specific team needs them.
- Block write or post actions to company-wide channels.
6. Add a governance layer with approvals
You can use Zap approvals to add an extra check on top of your allowed list: team members create Zap workflows freely with allowed apps, but admins review before Zap workflows publish and run.
If you allow QuickBooks but only want your accounting team to use it, add QuickBooks to your allowed list and then add an exception that limits it to the accounting team. The rest of your account will still be unable to use the app.
App access policies affect both Zap workflows and Agents. When planning changes to your allowed list, review both your Zap workflows and Agents to ensure all workflows continue to run as expected.
Legacy: restricted apps
Some Enterprise accounts created before October 5, 2026, and Team accounts that upgraded to Enterprise, use the legacy restricted apps setting instead of allowed apps. A new workspace added to an existing organization uses the same setting as the most recently created workspace. If that workspace has no setting configured, the new workspace uses allowed apps. With restricted apps, app access is open: members can use any app on Zapier unless it's on your restricted list.
You can:
- Add restricted apps.
- Add member or team exceptions.
Restricted apps does not support prohibiting specific triggers and actions within an app. Otherwise, a restricted app behaves the same way as an app that is not allowed: members cannot publish new or edited Zap workflows that include it, Agents that use it may not run as expected, and steps that use it in existing Zap workflows are held when the Zap runs.
You cannot have both settings enabled simultaneously.
Switching between restricted apps and allowed apps
Switching between the two settings is temporarily unavailable while Zapier builds the new app access experience. Accounts on the legacy setting will move to the new experience when it becomes available. To request early access to the new experience, submit an Enterprise feature request and select Advanced enterprise app controls.
If your account's policy changes, here's what to expect:
From restricted apps to allowed apps:
- Any published Zap that uses an app not on your allowed list will remain on, but steps using that app will be held when the Zap runs.
- Agents that use an app not on your allowed list may not run as expected.
- Members will not be able to publish new or edited Zap workflows that include apps not on the allowed list.
From allowed apps to restricted apps:
- Zap workflows and Agents that previously used prohibited apps can run again, unless those apps are now on the restricted list.
- Any held runs from the previous policy can be replayed as long as the app is now permitted.
Before any policy change, add all the apps your team currently uses to the new list, let members know which apps will be impacted, and plan to monitor held Zap runs after the change.
Next steps
Now that you understand how allowed apps work and how to plan your list, you're ready to configure your settings.
- Configure app access settings for your Enterprise account to add allowed apps and action restrictions
- Learn about Zap approvals to add governance to your workflows
- Review user roles and permissions to understand who can manage app access settings