App-only access is an authorization model where software acts under its own identity, such as an app registration or service account, instead of a signed-in user. The application uses permissions granted directly to that identity, so its capabilities are defined by policy rather than by a person’s session.
This matters in cyber security because app-only access can be powerful: bots, integrations, and automation often use it to read mail, manage files, or trigger infrastructure changes. If those permissions are too broad, a chat request or webhook can become a dangerous control path. Defenders should separate request, approval, and execution, limit app permissions to the minimum needed, and re-check authorization at action time. In logs and investigations, app-only access is useful because it makes the acting principal explicit and helps distinguish a user action from an automated one.