Malicious Apps

Malicious apps

Third-party applications that have access to your Microsoft 365 tenant or to users' data can be abused by attackers—for example, to read email, access files, or maintain persistence after a compromise. Petra tracks applications that have been flagged as malicious or risky and displays them in a malicious apps list so you can review and revoke access. This article explains what malicious apps are in Petra and how to handle them.

What a malicious app is in Petra

In Petra, a "malicious app" is an application (or app registration) that has been identified as risky, abusive, or known to be used in attacks. Petra may flag it automatically based on behavior or threat intelligence, or your team may add an app to the list after investigation. Each entry is tied to a tenant and usually includes the app name, a description of why it was flagged (e.g., "often abused by attackers," "no legitimate use observed in this tenant"), and a triage status—whether it's still under review or has been confirmed and should be removed. The goal is to give you a clear list of apps that need attention so you can revoke their access and reduce risk.

What you'll see

You'll typically see a list or table of malicious apps for the tenant (or across your tenants). Each row may show the app name, the tenant, when it was added, the triage status (e.g., untriaged vs. triaged), and whether it's published (visible to your team). You can open an app to see more detail and, when remediation is enabled, you may have the option to disable or revoke the app's permissions from Petra. That way you don't have to switch to the Microsoft admin center to remove the app unless you need to.

What to do

For each malicious app, the goal is to remove its access to the tenant. If Petra offers a "disable" or "revoke" action, use it so the app can no longer access mail, files, or other data. If you need to do it in Microsoft 365, use the app details in Petra to identify the app and then revoke it in the Azure or Microsoft 365 admin center. After you've handled the app, update its triage status so your team knows it's been addressed. Keeping the malicious apps list up to date and acting on every entry helps prevent attackers from using third-party apps as a back door into your tenants.