App governance is the administrative control of which third-party apps can connect to organization data, and what they are allowed to do once connected. In cloud platforms, this usually means approving, blocking, restricting, or removing apps based on risk, business need, and the permissions they request. Governance is important because a user’s approval can create delegated access without revealing a password.
In cyber attacks, malicious or lookalike apps often abuse OAuth consent prompts to gain mail, file, calendar, or directory access. Once a user approves the app, the attacker can keep using that granted access until it is revoked, even if the password changes. Defenders use app governance to reduce that risk by limiting high-risk scopes, allowing only trusted apps, reviewing consent grants, and revoking suspicious integrations. Good governance treats app approval as a security control, not a routine click.