An app-only token is an access token issued to an application acting as itself, rather than on behalf of a signed-in user. In Microsoft 365, an application can use this token to call Microsoft Graph under permissions granted to its identity, often represented in a tenant by a service principal. The token’s permissions determine which resources and actions the application can access.
App-only access is useful for automated services, such as backups, but a compromised application credential could let an attacker request tokens and use the app’s granted permissions. Defenders should limit application permissions to what the service needs, protect and rotate its credentials, and review tenant consent, service-principal access, and audit records. Revoking a credential can prevent new tokens from being issued, but teams may also need to investigate and remove unwanted access within each tenant.