TP: If you're able to ensure that the OAuth app is delivered from an unidentified supply, and redirects into a suspicious URL, then a real beneficial is indicated.Verify whether or not the app is critical in your organization right before looking at any containment actions. Deactivate the application working with app governance or Microsoft Entra I