Verify whether or not the application is crucial towards your organization prior to looking at any containment actions. Deactivate the app using app governance or Microsoft Entra ID to avoid it from accessing assets. Existing application governance policies may have already deactivated the app.