Validate if the application is important on your Group in advance of thinking of any containment actions. Deactivate the application working with app governance or Microsoft Entra ID to prevent it from accessing resources. Present application governance guidelines might need by now deactivated the app.FP: If soon after investigation, it is possible