Document scope management and update Mobile and Third-Party Access by nirrattner · Pull Request #35705 · DataDog/documentation

nirrattner · 2026-04-01T16:05:49Z

What does this PR do? What is the motivation?

This PR makes a few changes:

Updates the Organization Settings OAuth App documentation by replacing references to "OAuth App" with "Mobile and Third-Party Access", which is the term now used in the application. This includes:
- Replacing screenshots
- Updating the names of the permissions which are now used for this page from org_management to org_authorized_apps_read and org_authorized_apps_write
Introduces documentation for the Application Scope Management feature which will soon be available on the Mobile and Third-Party Access page

Merge instructions

Merge readiness:

Ready for merge

AI assistance

Used Claude Code for initial draft.

github-actions · 2026-04-01T16:09:58Z

Preview links (active after the `build_preview` check completes)

New or renamed files

https://docs-staging.datadoghq.com/nir.rattner/scope-management/account_management/org_settings/mobile_third_party_access

Removed or renamed files (these should redirect)

https://docs-staging.datadoghq.com/nir.rattner/scope-management/account_management/org_settings/oauth_apps

Modified Files

adityab-datadog · 2026-04-01T17:02:38Z

content/en/account_management/org_settings/mobile_third_party_access.md

+
+### Enable
+
+Enabled OAuth applications allow users with necessary permissions to authorize access on their behalf. OAuth applications include the Datadog Mobile App and MCP (Model Context Protocol) OAuth clients registered through Dynamic Client Registration.


There's reference to MCP clients here - would it be premature to release these docs before we migrate away from the singleton proxy being used now?

Yeah good point, updating this

samanthasample · 2026-04-01T17:20:22Z

config/_default/menus/main.en.yaml

-      url: account_management/org_settings/oauth_apps
+    - name: Mobile and Third-Party Access
+      identifier: account_management_org_settings_mobile_third_party_access
+      url: account_management/org_settings/mobile_third_party_access


Should we be wary of updating this URL? It could be referenced in other docs

Good catch, just updated the references within the documentation and also introduced an alias so that the old URL will redirect to the new page for any references outside of our control

…ferences

iadjivon

Hi there, thanks for this PR. I've added some comments here. Please let me know once this is ready for re-review.

iadjivon · 2026-04-02T14:09:09Z

content/en/account_management/safety_center.md

-    - link: "/account_management/org_settings/oauth_apps"
+    - link: "/account_management/org_settings/mobile_third_party_access"
      tag: "Documentation"
      text: "OAuth Apps"


Should this be changed to Mobile Third Party Access?

Good catch, yes!

iadjivon · 2026-04-02T14:21:40Z

content/en/account_management/org_settings/mobile_third_party_access.md

+
+The allowed scopes for an application can be modified by enabling Application Scope Management. Adding or removing a scope will affect the access for this application for all users in your organization. When a scope is disabled, all existing authorizations in your organization for that application that have the scope granted will be revoked.
+
+Currently, only MCP applications have support for Application Scope Management.


Suggested change

Currently, only MCP applications have support for Application Scope Management.

Only MCP applications support Application Scope Management.

iadjivon · 2026-04-02T14:22:51Z

content/en/account_management/org_settings/mobile_third_party_access.md

+
+### Application Scope Management
+
+The allowed scopes for an application can be modified by enabling Application Scope Management. Adding or removing a scope will affect the access for this application for all users in your organization. When a scope is disabled, all existing authorizations in your organization for that application that have the scope granted will be revoked.


Suggested change

The allowed scopes for an application can be modified by enabling Application Scope Management. Adding or removing a scope will affect the access for this application for all users in your organization. When a scope is disabled, all existing authorizations in your organization for that application that have the scope granted will be revoked.

Enable Application Scope Management to modify the allowed scopes for an application. Adding or removing a scope affects access to this application for all users in your organization. Disabling a scope revokes all existing authorizations in your organization for that application.

I modified this section to be in the active voice. Please let me know if this keeps the meaning.

Thanks! It mostly keeps the meaning, but there is some nuance that is lost in the last sentence. Only a subset of existing authorizations may be revoked, whereas the last sentence now indicates that all existing authorizations will be revoked. Specifically it is only the existing authorizations that would conflict with the new allowed scopes configuration that would be revoked. It's not clear to me if it's valuable to communicate that distinction in the documentation here?

That's a very fair point and important distinction. How about:

Disabling a scope revokes any existing authorization for that application where the scope was granted.

OR

Disabling a scope revokes any existing authorizations for applications that have the scope granted.

Or a focus on the user if applicable:

Disabling a scope revokes access for any user in your organization who was granted that scope for the application.

To me, this one seems cleanest:

Disabling a scope revokes any existing authorizations for applications that have the scope granted.

I can update that now, thanks!

iadjivon · 2026-04-02T14:31:57Z

content/en/account_management/org_settings/mobile_third_party_access.md

+1. In the **Application Scope Management** view, use the **Allowed** checkbox for each scope to control whether the application can be granted that scope.
+
+{{< img src="account_management/mobile_third_party_access/scope-restrictions-enable.png" alt="Application Scope Management view with Enable and Restore to Full Access buttons" style="width:100%;">}}
+
+2. After making your changes, click **Enable** to save the scope configuration.


Suggested change

1. In the **Application Scope Management** view, use the **Allowed** checkbox for each scope to control whether the application can be granted that scope.

{{< img src="account_management/mobile_third_party_access/scope-restrictions-enable.png" alt="Application Scope Management view with Enable and Restore to Full Access buttons" style="width:100%;">}}

2. After making your changes, click **Enable** to save the scope configuration.

1. On the **Mobile and Third-Party Access page**, click an application to open its detail view.

2. Select the **Scopes** tab and use the **Allowed** checkbox for each scope to control whether to grant he application that scope.

3. Click Enable to save the scope configuration.

{{< img src="account_management/mobile_third_party_access/scope-restrictions-enable.png" alt="Application Scope Management view with Enable and Restore to Full Access buttons" style="width:100%;">}}

I'd recommend these steps. Let me know what you think.

iadjivon · 2026-04-02T14:33:00Z

content/en/account_management/org_settings/mobile_third_party_access.md

+[4]: /account_management/rbac/permissions/
+[5]: https://app.datadoghq.com/organization-settings/oauth-applications


Links [4] and [5] do not seem to be used in this file. Link [5] also still uses oauth-applications.

I'd recommend removing these links if they are not needed.

iadjivon · 2026-04-02T14:34:44Z

content/en/account_management/org_settings.md

+### Mobile and Third-Party Access

-The [**OAuth Apps**][15] page allows you to view or manage OAuth applications in your organization.
+The [**Mobile and Third-Party Access**][15] page allows you to view or manage Datadog Mobile and Third-Party applications in your organization.


Suggested change

The [**Mobile and Third-Party Access**][15] page allows you to view or manage Datadog Mobile and Third-Party applications in your organization.

The [**Mobile and Third-Party Access**][15] page allows you to view and manage mobile and third-party applications in your organization.

iadjivon · 2026-04-02T14:36:53Z

static/images/account_management/mobile_third_party_access/disable-app-detailed.png

I don't think this is used in the page. I'd recommend removing it so that is is not merged.

Good catch, thanks!

iadjivon · 2026-04-02T14:39:01Z

content/en/account_management/org_settings/mobile_third_party_access.md

+
+Disabling OAuth access for an application revokes access to this application for all users in your organization. While the application remains installed, users are no longer able to use the application and are prompted with an error if they attempt to authorize it.
+
+There are two ways to disable an application from the Mobile and Third-Party Access page:


Suggested change

There are two ways to disable an application from the Mobile and Third-Party Access page:

To disable an application from the Mobile and Third-Party Access page:

Quick edit to the legacy content.

content/en/account_management/org_settings/mobile_third_party_access.md

Document scope management and update Mobile and Third-Party Access

4323927

github-actions bot added Architecture Everything related to the Doc backend Images Images are added/removed with this PR labels Apr 1, 2026

adityab-datadog reviewed Apr 1, 2026

View reviewed changes

samanthasample reviewed Apr 1, 2026

View reviewed changes

Update OAuth application description. Support alias and update URL re…

3a5f40f

…ferences

samanthasample approved these changes Apr 1, 2026

View reviewed changes

nirrattner marked this pull request as ready for review April 2, 2026 12:35

nirrattner requested a review from a team as a code owner April 2, 2026 12:35

anthony-dgx approved these changes Apr 2, 2026

View reviewed changes

Merge branch 'master' into nir.rattner/scope-management

c1e7ea0

iadjivon reviewed Apr 2, 2026

View reviewed changes

nirrattner added 2 commits April 2, 2026 11:42

Remove unused image and update copy based on feedback

90a1bf5

Update wording for revoking existing authorizations

f94ae6c

iadjivon approved these changes Apr 2, 2026

View reviewed changes

iadjivon reviewed Apr 2, 2026

View reviewed changes

content/en/account_management/org_settings/mobile_third_party_access.md Outdated Show resolved Hide resolved

Apply suggestion from @iadjivon

7ce72b4


		### Enable

		Enabled OAuth applications allow users with necessary permissions to authorize access on their behalf. OAuth applications include the Datadog Mobile App and MCP (Model Context Protocol) OAuth clients registered through Dynamic Client Registration.


		The allowed scopes for an application can be modified by enabling Application Scope Management. Adding or removing a scope will affect the access for this application for all users in your organization. When a scope is disabled, all existing authorizations in your organization for that application that have the scope granted will be revoked.

		Currently, only MCP applications have support for Application Scope Management.

	Currently, only MCP applications have support for Application Scope Management.
	Only MCP applications support Application Scope Management.


		### Application Scope Management

		The allowed scopes for an application can be modified by enabling Application Scope Management. Adding or removing a scope will affect the access for this application for all users in your organization. When a scope is disabled, all existing authorizations in your organization for that application that have the scope granted will be revoked.

	The allowed scopes for an application can be modified by enabling Application Scope Management. Adding or removing a scope will affect the access for this application for all users in your organization. When a scope is disabled, all existing authorizations in your organization for that application that have the scope granted will be revoked.
	Enable Application Scope Management to modify the allowed scopes for an application. Adding or removing a scope affects access to this application for all users in your organization. Disabling a scope revokes all existing authorizations in your organization for that application.

		[4]: /account_management/rbac/permissions/
		[5]: https://app.datadoghq.com/organization-settings/oauth-applications

	The [Mobile and Third-Party Access][15] page allows you to view or manage Datadog Mobile and Third-Party applications in your organization.
	The [Mobile and Third-Party Access][15] page allows you to view and manage mobile and third-party applications in your organization.


		Disabling OAuth access for an application revokes access to this application for all users in your organization. While the application remains installed, users are no longer able to use the application and are prompted with an error if they attempt to authorize it.

		There are two ways to disable an application from the Mobile and Third-Party Access page:

	There are two ways to disable an application from the Mobile and Third-Party Access page:
	To disable an application from the Mobile and Third-Party Access page:

Conversation

nirrattner commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do? What is the motivation?

Merge instructions

AI assistance

Uh oh!

github-actions bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview links (active after the build_preview check completes)

New or renamed files

Removed or renamed files (these should redirect)

Modified Files

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iadjivon left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iadjivon Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nirrattner commented Apr 1, 2026 •

edited

Loading

github-actions bot commented Apr 1, 2026 •

edited

Loading

Preview links (active after the `build_preview` check completes)

iadjivon Apr 2, 2026 •

edited

Loading