Dependant on your investigation, disable the app and suspend and reset passwords for all influenced accounts.FP:?When you’re?in the position to?validate?application has carried out unique knowledge from SharePoint or OneDrive lookup and collection by Graph API by an OAuth app and produced an inbox rule to a completely new or personalized exterior