TP: If you can affirm which the OAuth app is delivered from an unfamiliar resource, and redirects to a suspicious URL, then a true optimistic is indicated.Assessment all activities completed with the app. Evaluate the scopes granted because of the app. Evaluation any inbox rule action made by the app. Assessment any SharePoint or OneDrive search fu