Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
App Intelligence helps SharePoint administrators review how non-Microsoft applications access SharePoint content. It brings together available application permissions and activity to help you prioritize applications for review and understand why they might need attention.
App Intelligence provides information to support your review. It doesn't determine whether an application is malicious or change the application's permissions.
Availability and prerequisites
App Intelligence availability, required administrator role, and licensing depend on the current release and your tenant. Confirm that the feature is available to your organization and that your account has the required permissions before you use it.
App Intelligence depends on available assessment data. Activity might not be available immediately, and results are limited to the assessment window and data sources shown in the experience.
Review applications with App Intelligence
In the SharePoint admin center, open App Intelligence.
In the Copilot pane, select Review priority apps to identify applications that might need immediate review.
Review the results. An assessment can include the application, likely behavior, sites reached, resource impact, reasons for review, and the assessment window, depending on the available data.
Assess privileged access
To focus on applications with broad permissions, select Assess privileged access. Review each application's permission scope and evidence.
Permissions describe what an application is allowed to access. They don't prove that it used all of that access.
Privileged-access results are based on available SharePoint and OneDrive access signals, such as:
Permission breadth (for example, broad or tenant-wide scopes)
Access model (for example, app-only access)
Effective reach (for example, sites reached and sensitive sites reached)
Available activity evidence in the assessment window
Understand why an application needs review
To investigate a result, ask why the application needs review or why it has a high resource impact. Check whether each explanation is based on permissions, observed activity, or both. Review the assessment window and data availability before acting.
App Intelligence can use different evidence modes:
Capability only: Permissions indicate what an application can do. They don't prove that it performed those actions.
Observed behavior: Available activity data indicates what the application did during the stated assessment window. It might not represent all activity.
Mixed: The explanation uses both permission and activity evidence.
How App Intelligence prioritizes applications for review
The Review priority apps result is a review queue, not a malware verdict. Prioritization uses available evidence, including:
Permission breadth and access model
Effective resource reach (for example, total sites and sensitive sites reached)
Observed activity patterns in the assessment window
Available context and evidence quality (including missing or stale data)
Current review state from the assessment run
Each prioritized app includes reasons to explain why it was surfaced for review.
How resource impact is determined
Resource impact—such as High, Medium, Low, or Needs Data—helps you prioritize review. It's based on available permission capability, observed activity, effective reach, sensitivity context, and evidence completeness in the assessment window.
Resource impact isn't a universal security score. Low doesn't mean an application is approved or risk-free, and Needs Data doesn't mean there was no activity.
Likely behavior is an interpretation of available evidence, not a verified statement of an application's business purpose. Missing or conflicting information can require further review.
Export an assessment
To review exported results, select View assessment report and then Download CSV. The report can include applications requiring review, likely behavior, permission scope and evidence mode, resource impact, sites reached, assessment reasons, missing data, and the assessment window.
Notify app owners
To notify owners of flagged applications during review:
Run Review priority apps and confirm the apps that require follow-up.
Select Notify App Owner and choose which flagged apps to include.
Open the generated notification preview link, review the owner-email draft, and then send.
The notification flow keeps the message in preview until an administrator confirms send.
Use the preview to verify recipients, subject, and app list before sending owner communication.
Data and coverage
App Intelligence relies on available SharePoint application-access information. The existing App Insights reports use audit data for FileAccessed, FileDownloaded, FileModified, and FileUploaded events; they don't include every audit event. Data collection and reporting delays can affect what is available.
The assessment window shown in the experience defines the period covered by a result. An absence of activity in that window doesn't establish that an application has never accessed content.
App restrictions
Use app restrictions when you decide an application should have reduced access to SharePoint content.
To restrict an application's access, follow your organization's administrator procedures and use the supported Restricted Access Control (RAC) for Apps PowerShell commands.
Relevant PowerShell commands:
Set-SPOTenantRestrictedAppAccessControlList: Add or remove application IDs from the restricted app list.Enable-SPOTenantRestrictedAppAccessControl: Enable tenant-level Restricted Access Control.Get-SPOTenantRestrictedAppAccessControl: Check the current Restricted Access Control state.
Important
Enabling Restricted Access Control is a tenant-wide change. Review the expected impact before applying restrictions.
App restrictions require explicit administrator action. App Intelligence doesn't automatically apply restrictions as part of assessment or notification.
To learn more about the existing report workflow, go to Generate Enterprise App Insights reports.
App Intelligence FAQ
How is App Intelligence different from App Insights?
App Insights provides reports based on audit data about non-Microsoft applications accessing SharePoint content. App Intelligence adds an assessment that helps administrators prioritize applications and interpret available permissions, activity, and reach.
Does a high resource impact mean that an application is unsafe?
No. It indicates that the available evidence might warrant closer review. Consider the permissions, observed activity, sites reached, and assessment window before deciding what to do.
Why can an app be prioritized when activity appears limited?
Priority can come from permission capability and effective reach, not just observed activity. If activity evidence is limited or unavailable, App Intelligence can still surface the app for review and indicate capability-only or incomplete evidence.
Does privileged access mean the app is malicious?
No. Privileged access indicates broad authorized capability or elevated access patterns. It doesn't prove harmful behavior. Use the explanation, evidence mode, and assessment window to interpret the result.
Is resource impact a numeric risk score?
No. Resource impact is an explainable assessment level (High, Medium, Low, or Needs Data) based on available evidence. It's designed to support prioritization and review decisions.
Is App Intelligence enforcement?
No. App Intelligence is advisory. It helps administrators understand available evidence and prioritize review actions. Policy and access decisions still require administrator judgment.
Does App Intelligence change application permissions?
No. App Intelligence helps you review available evidence. It doesn't change application grants or replace Microsoft Entra application-permission management.
What if activity or other information is missing?
The assessment can be limited by unavailable or stale data. Treat Needs Data or Needs Review as a reason to investigate further, not as proof that there was no activity or that the application is unsafe.