TP: If you can confirm which the OAuth application has encoded the Show title with suspicious scopes sent from an unknown resource, then a true positive is indicated.Encouraged actions: Classify the alert for a TP. Based on the investigation, In the event the app is malicious, you could revoke consents and disable the app in the tenant.New consumer