An app was allowed to read mail or files

What happened

Someone allowed an outside app to read or send mail, or to read files. Malicious apps use this to copy everything without a password.

Serious: deal with it today.

Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.
Remove the app: Microsoft Entra admin center → Enterprise applications → the app → Properties → Delete (or Permissions → Revoke).
Open the page: entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Stop staff from approving apps alone: Microsoft Entra admin center → Enterprise applications → Consent and permissions → allow user consent only for apps from verified publishers.
Open the page: entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.
Open the page: entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.
Remove the app: user page → Security → Connected applications → the app → Remove. To block it for everyone: Security → Access and data control → API controls → Manage third-party app access.
Open the page: admin.google.com/ac/owl/list?tab=apps
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Fixed when the app is removed and staff can no longer approve unknown apps alone.

Call your IT provider now if the person didn't do this, or if you are unsure.