An OAuth application has suspicious consent and access to organizational data. Which response addresses that authorization path?

1. Change only the application's display name
2. Disable audit logging for the application
3. Reset one user's password and ignore application grants
4. Investigate permissions and activity, then revoke or disable the application access as authorized