TP: If you're able to ensure that abnormal actions, for example higher-quantity usage of SharePoint workload, were being carried out via the application by Graph API.If you still suspect that an app is suspicious, you may investigation the application Display screen identify and reply area.FP: If you can verify that no unconventional routines ended