Knowledge Base - Trusted App Labeled Risky

Overview:

Apps tab captures connections granted by accounts related to the domain. Certain apps require permission approvals for access and functionality. Connection scopes can range from simple SSO access to more advanced admin management access.

Detail:

Apps summary section highlights a "Risk" score for each discovered connection. App scores are not affected by the popularity or reputation of the resource. Risk values are determined by evaluating the related scope permissions. Details can be evaluated further by clicking the "Scope Categories" column arrow. Scopes that allow for vast access into things like management of files, emails or domain access would result in risk values of "High" or "Critical". 

Sanction:

The "Sanction" action indicates an app has been reviewed and approved for domain use by admin. This is beneficial for ensuring apps containing high level scope connections are legitimate and associated with appropriate accounts.

Revoke:

The "Revoke" action triggers a one time removal of app connections. This option is utilized when an app does not pass admin approval. Users will be prompted to reapprove app scopes if revisited after the action completes.