I know that I can run a query in the Policy Analyzer, but that only seems to show resources that are inside my organization.

In the particular case I am working on, the service account had access to an external spreadsheet that had been shared to it and so I am trying to find where something like this (or any other access permission) would show up so I can make sure there are no unexpected ones.