This detection identifies when an app consented to suspicious OAuth scope and created a substantial volume of strange email research things to do, including e mail seek for unique content in the Graph API.FP: If just after investigation, you could affirm which the application features a reputable organization use while in the Firm.TP: In the event