TP: If the application is not known or not getting used, the supplied action is most likely suspicious and should call for disabling the app, following verifying the Azure resource being used, and validating the app usage inside the tenant.A non-Microsoft cloud application designed anomalous Graph API phone calls to OneDrive, like significant-quant