Validate if the application is significant on your Group just before thinking about any containment steps. Deactivate the app using app governance or Microsoft Entra ID to stop it from accessing means. Existing app governance insurance policies might need presently deactivated the application. FP: If just after investigation, you are able to