Zapier AI Security Guide: Connections, Agents, MCP

Every Zapier app connection is a stored credential that can act in a business system without a person present, and Zapier's AI features now let models choose which of those connections to use. Zapier Agents, AI steps in Zaps and Zapier MCP turn a familiar integration tool into an agent platform whose reach equals the sum of its users' connections. This guide explains how identity and access work in Zapier, the admin roles and Enterprise governance controls, how connections, API credentials and MCP servers behave as non-human identities, what the audit log and log streams record, and a hardening baseline. It is written for security architects, SaaS administrators and identity teams who own or approve Zapier use. Plan availability is noted where it matters, because many governance controls are Enterprise only.

Key takeaways

Connections are the real attack surface. Each app connection holds an OAuth token, API key or password tied to one user, and anyone it is shared with can build workflows that use it.
MCP is on by default. Zapier MCP is enabled for all accounts, including Enterprise, so any user can expose their connections to an AI client unless an admin restricts it.
Govern apps and connections centrally. Enterprise app access settings, allowed domains and managed apps decide which apps, actions and accounts can be connected, but each covers a different gap.
AI output is non-deterministic. Agents can behave differently between runs, so scope their tools, review their activity logs and screen output where it reaches customers or systems.
Logging depends on plan. The audit log covers 6 months on Team and 12 months on Enterprise, and real-time log streams to a SIEM are Enterprise only.

How identity and access work in Zapier

Zapier runs workflows (Zaps), AI agents and MCP tool calls in its own cloud using credentials that users connect. People sign in to Zapier; Zapier then signs in to everything else on their behalf. The security model rests on a few objects.

Object	What it is	Security relevance
User account and workspace	A person's Zapier login, grouped into workspaces on Enterprise	Enterprise supports SAML SSO and SCIM provisioning, and SSO extends to MCP access.
App connection	Stored authentication to a third-party app: OAuth 2.0, API key, basic, session or digest	Linked to a single user, reusable across many Zaps and agents. Each user can hold up to 5,000 connections.
Zap	A trigger and actions that run with the chosen connections	Runs unattended, so a misconfigured step acts with the connection's full rights.
Agent	An AI agent that plans and calls tools using connections	Zapier notes agents may behave differently between runs and is moving Agents into AI by Zapier.
MCP server	A Zapier-hosted endpoint that exposes actions as tools to MCP clients such as Claude, ChatGPT, Cursor and VS Code	Tool calls run through the same connections Zaps use. Clients authenticate by OAuth or a connection token.
API by Zapier and API credentials	Programmatic access and generic API connections	Not governed by app access controls or allowed domains; Zapier advises marking it as a managed app.

Two properties matter most. First, permissions are inherited from the connected account: Zapier can only do what that account can do, so an admin's connection gives every workflow admin rights in the target app. Second, Zapier is a concentration point. It holds tokens for many apps across many users, which is the same pattern that made the Salesloft Drift breach 2025 so damaging when an integration vendor's stored OAuth tokens were stolen and replayed against hundreds of Salesforce tenants. Your controls should assume a connection could be misused, whether by a user, an agent or an attacker. See the Low-Code Agent Platforms Guide for the wider category.

Admin roles and privileged access

On Enterprise, roles sit at two levels: organisation (Owner, Super Admin) and workspace (Admin, Member). Access to a workspace depends on User Groups mapped to it, and where a user has several group roles the highest applies.

Capability	Owner	Super Admin	Workspace Admin	Workspace Member
View and delete all app connections	Yes	Yes	Yes	No
View others' shared and private Zaps	Yes	Yes	No	No
Audit log and log streams	Yes	Yes	No	No
App restrictions	Yes	Yes	Yes	No
Access all workspaces automatically	Yes	Yes	No	No
Billing and plan	Manage	View only	No	No
Access all MCP servers	Yes	Yes	Not stated	No

Keep organisation roles rare: Owners and Super Admins can log in to any workspace and see every private Zap, so treat them as privileged accounts with phishing-resistant MFA at the identity provider.
Use SSO and SCIM: SAML SSO means a disabled identity provider account loses Zapier access, and SCIM removes leavers automatically. See the SCIM Provisioning Guide.
Plan for the leaver's connections: connections belong to a user. Before removing an account, use Change ownership on each connection, or Zaps that depend on it will stop. Managed app connections belong to the company and survive offboarding. See the NHI Offboarding and Decommissioning Guide.
Review members regularly: reconcile account members against your HR source each quarter, even with SCIM, to catch local accounts and contractors.

Integrations, API tokens and service accounts

Connections and sharing

On Team and Enterprise plans, a user can share a connection with named users, teams or everyone. Recipients do not see the login, but they can build and edit Zaps that use the connection, which is effectively delegated use of the owner's identity. Revoking a share pauses published Zaps that rely on it. Enterprise admins can turn off Share with everyone for the account.

Connect service accounts, not people: where the target app supports it, connect a dedicated integration account with only the scopes the Zap needs, rather than a personal or admin login.
Prefer OAuth over API keys: OAuth connections can be scoped, revoked from the target app and restricted by allowed domains; API keys usually cannot. See the API Keys vs OAuth Tokens Guide.
Prune connections: Zapier recommends regularly removing outdated connections. Every unused connection is a live token with no business owner, the pattern behind the Klue OAuth breach 2026, where a forgotten pilot credential opened customer Salesforce data.

Enterprise governance controls

Control	What it does	Gap it leaves
App access settings (allowed apps)	Allowlist apps, restrict individual triggers and actions, add exceptions per user or team. Default for Enterprise accounts created from 5 October 2026; older accounts may use a legacy restricted apps list.	Zapier may default to the broadest permissions for an app, which can override a specific restriction. Requires a verified domain. API by Zapier is not covered.
Allowed domains for app connections	Only accounts on approved email domains can be connected via OAuth, blocking personal accounts. Set under Admin Center > Governance > App connections; include `zap.com` and `zapier.com`.	OAuth only, for a listed set of apps such as Gmail, Google Drive, Microsoft Outlook, Microsoft Teams, Salesforce, Slack, GitHub and Notion. Existing connections are not affected.
Managed apps	Only admins create, share or delete connections for designated apps; members use admin-shared connections	Existing member-created connections remain; review and remove them separately.
Custom actions setting	Account-level control over creating custom actions	Separate from app restrictions, so set both.
Bring Your Own Model	Use your organisation's chosen AI model provider	Changes where prompts go, not what connections can do.

Zapier MCP

Zapier MCP lets any MCP client call Zapier actions as tools over Streamable HTTP. A server runs in Agentic mode, where the AI finds and adds the actions it needs during the conversation, or Managed mode, where you choose a fixed set of actions. Each successful tool call uses two tasks. Users can only use connections they own or that are shared with them, and account-level app and action restrictions apply to MCP. Sharing server access lets others add or manage tools but not run tools as the owner.

Choose Managed mode for anything sensitive: Agentic mode lets the model widen its own toolset mid-conversation, which defeats least privilege. See the MCP Security Guide.
Decide where MCP is allowed: admins can enable or disable MCP per workspace through their account manager and set task quotas per workspace. Because it is on by default, make this an explicit decision.
Protect connection tokens: clients that cannot use OAuth authenticate with a connection token; store it as a secret, never in shared config files or repositories.
Use the kill switch: Zapier can disable MCP for an account immediately on request, which belongs in your incident playbook.

Agents and AI steps

An agent with read access to an inbox and write access to a CRM or chat tool can be steered by any text it reads. Limit each agent to the connections its task needs, keep side-effect actions behind human approval, and screen output. AI Guardrails by Zapier checks AI-generated text for PII, prompt injection, sentiment and toxicity, can be paired with Human in the Loop in Zaps, and can be added as a tool for agents and MCP servers. It is available on all plans, does not retain content, and Zapier states no AI detection system is fully accurate, so use it as one layer. See the Prompt Injection Guide and the Generative AI Data Loss Prevention Guide.

Logging and detection

Zapier offers three sources. The audit log (Team and Enterprise) records events for app connections, variables, MCP servers, tables, account management, API credentials, folders and Zaps, with 6 months of history on Team and 12 months on Enterprise. Log streams (Enterprise, configured by Owners or Super Admins) push audit events and Zap execution events (zap_execution.success, zap_execution.error, zap_execution.halted) as JSON over HTTPS POST. The MCP History tab and the agent Activity log show tool calls; Super Admins can review MCP history for any user.

Configure a log stream secret (16 to 255 characters) so Zapier signs each request with HMAC-SHA256; verify the X-Zapier-Signature header against the raw body and X-Zapier-Timestamp using constant-time comparison. Streams only carry events from creation onward, so set them up before you need them. Execution payloads include owner name and email, so treat the receiving index as personal data. See the Webhook Secrets Security Guide.

Detection	Source	Response
New connection to a sensitive app, or a connection shared with everyone	Audit log app connection events	Confirm business owner and scope; unshare or convert to a managed app
New MCP server or tools added to a server	Audit log MCP server events	Check mode (Agentic or Managed) and the connections exposed
API credential created or changed	Audit log API credentials events	Verify the owner and intended integration
Spike in halted or errored runs on a Zap touching a restricted app	Log stream execution events	May indicate a revoked token, policy hold or misuse
Unusual volume of MCP tool calls by one user	MCP History tab	Review prompts and parameters; reduce quota or disable MCP for the workspace

Correlate with the target apps' own logs: a Zapier connection appears there as API activity by the connected account, which is where bulk exports and unusual queries show up. Relevant ATT&CK techniques are T1528 Steal Application Access Token and T1567 Exfiltration Over Web Service.

Metrics:

Percentage of connections to sensitive apps that are managed or use dedicated integration accounts.
Number of connections with no Zap or agent use in 90 days.
Number of MCP servers in Agentic mode, and users with MCP enabled.
Percentage of agents with side-effect tools behind human approval.
Time from leaver notice to connection ownership transfer or deletion.

Hardening baseline

Discover. Find every Zapier account in use, including personal Free and Professional accounts connected to corporate apps, and bring them under the company account. See the Shadow AI Discovery Guide.
Centralise identity. Enable SAML SSO and SCIM, map User Groups to workspaces, and keep Owners and Super Admins to a named few.
Decide app policy. Start app access settings with an allowlist of approved apps, restrict high-risk actions such as delete, send and export, and test exceptions with a pilot team before applying to everyone. Zaps that use an app that is no longer allowed are held at that step, so review the Apps page for affected Zaps before enforcing; roll back by adding a temporary exception.
Lock down connections. Turn on allowed domains, mark API by Zapier and API-key apps holding sensitive data as managed apps, disable Share with everyone, and convert critical personal connections to managed ones.
Govern AI. Decide per workspace whether MCP is enabled, require Managed mode for servers touching sensitive data, add AI Guardrails and human approval to agents with side effects, and set task quotas.
Monitor. Create log streams to the SIEM, alert on the detections above and run a quarterly connection review.

Small versus large organisations: on Team, there are no app restrictions, allowed domains or log streams, so compensate with a written policy, quarterly reviews of the audit log, integration accounts with narrow scopes and restrictions set in the target apps (such as OAuth app approval in Google Workspace or Microsoft Entra). Enterprise customers should use the full governance stack and treat Zapier as a privileged third party in vendor risk, reviewing its SOC 2 Type II report. Zapier stores customer data in AWS US-East-1 and does not offer dedicated VPC or on-premises deployment, which matters for data residency decisions.

Common misconfigurations

Admin connections reused everywhere. A Google Workspace or Salesforce admin login connected once and shared with everyone, so any Zap or agent can act as an administrator.
MCP left at the default. Users connect AI clients in Agentic mode to connections holding mailbox and CRM rights, with no admin decision on whether that is allowed.
Relying on one control. Allowed domains do not cover API keys or API by Zapier, and app restrictions do not cover API by Zapier, so a gap remains unless managed apps are also used.
Orphaned connections after leavers. Accounts removed without transferring ownership break Zaps, so teams quietly reconnect with someone else's personal credentials.
No log stream until an incident. Streams carry no history, and execution events never appear in the audit log, so the investigation starts blind.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
Roles, SSO and SCIM	AC-2, AC-6	PR.AA-05	5, 6	A.5.15, A.8.2
Connections and tokens	IA-5	PR.AA-05	6	A.5.17
App inventory and restrictions	CM-7	ID.AM-02	2	A.5.9
Zapier as a supplier	SA-9, SR-3	GV.SC-07	15	A.5.19, A.5.23
Audit log and log streams	AU-2, AU-6	DE.CM-09	8	A.8.15, A.8.16

Practitioner checklist

Find all Zapier accounts touching corporate apps and consolidate them under the company account.
Enable SAML SSO and SCIM and keep Owner and Super Admin roles to a named few.
Apply an app allowlist and restrict high-risk actions, testing with a pilot group first.
Enable allowed domains and mark API by Zapier and sensitive API-key apps as managed apps.
Replace personal and admin connections with scoped integration accounts and disable Share with everyone.
Make an explicit decision on MCP per workspace and require Managed mode for sensitive servers.
Add human approval and AI Guardrails to agents with side-effect tools.
Stream audit and execution events to the SIEM with signed requests verified.
Transfer or delete a leaver's connections as part of offboarding.

Zapier AI Security Guide: Connections, Agents and Data Exposure