IDENTITY PROVIDER ALERT
Users granting apps access is normal activity. The question is which access, and why now.