Call end users and admins that have granted consent to this application to substantiate this was intentional and also the abnormal privileges are typical. FP: If you can ensure that no uncommon actions had been carried out via the app or that the app is meant to make unusually high volume