---
title: Apps
description: Discover every application connected to your tenant - including the ones users consented to without IT - and see exactly what each can read, who let it in, and whether it's still used.
icon: AppWindow
---

# Apps

The Apps screen answers a question most organizations can't: **"Which third-party apps and AI tools are secretly reading our data - and who let them in?"** Every OAuth consent an employee clicked, every add-in, every vendor integration and managed identity is a standing credential into your data. Most tenants have hundreds; almost none can list them, let alone say what each one reaches.

## What You Can Achieve

<Cards>
  <Card
    title="Discover shadow IT and shadow AI"
    description="Apps arrive through user consent screens, not procurement. See every application with a foothold in your tenant - including AI tools employees connected themselves - the day it appears."
  />
  <Card
    title="Know how each app got in - and who let it"
    description="Tenant-wide admin grant or one user's consent click? 1Security records the access channel and the first admin who consented, so accountability survives staff turnover."
  />
  <Card
    title="Rank apps by what they can touch"
    description="An app with mail-read permissions and reach into 40,000 files is not the same risk as a calendar widget. Sort by files, users, and sensitive-data reach instead of guessing from app names."
  />
  <Card
    title="Retire dormant integrations"
    description="Apps with no users or no activity for months keep their permissions forever. Find them and cut standing attack surface that delivers zero business value."
  />
</Cards>

## Access Channels - How Apps Really Get to Data

The single most important attribute of an app is not what it _is_ but how it _reaches_ your data. 1Security classifies every app's channel:

- **Tenant-wide app** - application permissions granted by an admin; reads data for _everyone_, no user present.
- **Admin-consent delegated** - an admin approved it to act on behalf of any user who signs in.
- **User consent** - an individual clicked "Accept". This is the shadow-IT channel - and the OAuth-phishing channel.
- **License-driven** - access implied by product licensing.
- **Explicit grant** - scoped, deliberate access to specific resources.
- **None** - present in the tenant, currently no data path. Still worth knowing about.

The screen also separates the five application flavors - **enterprise apps**, **app registrations**, **add-ins**, **agents**, and **managed identities** - and flags whether each publisher is **verified**.

## The App List

Each row quantifies an app's real footprint: files and users it can access (external users broken out), its permission levels to **files**, **user data**, and **email**, sensitivity labels and sensitive info within its reach, security alerts, when it was connected and by which admin, and an activity sparkline that separates the living from the abandoned.

Filters narrow by application type, access channel, Graph permission families (files, sites, chat, directory, audit logs, and more), publisher verification, sensitive-data reach, **orphaned indicators** (no users, no activity for a month or a year), and security alerts. Click any app for the full drawer view of its permissions and reach.

## Investigative Patterns

<Callout type="info">
  **The OAuth-phishing triage**: filter **user consent** + **unverified
  publisher** + file or email permissions. This is the exact pattern attackers
  use to turn one careless click into persistent mailbox access - review this
  list on a schedule, not after the incident.
</Callout>

- **Overpowered and idle** - **tenant-wide** channel + **no activity in the last year**: maximum privilege, zero use. Revoke candidates with no business pushback.
- **AI with reach** - application type **Agent** + sensitive info present, then continue in the [Agents screen](/en/docs/screens/agents) for knowledge-source-level detail.
- **Blast radius pre-read** - before approving a pending consent request, look up the app's current reach and alerts here; approve with numbers, not vibes.