TP: If you're able to affirm that the OAuth app is delivered from an not known resource, and redirects to the suspicious URL, then a true positive is indicated.FP: If you can confirm that no strange actions were being carried out through the application or the application is intended to make unusually high volume of Graph phone calls.Considered one… Read More