Over the weekend our account connected to suspicious apps, how can I check who did it and if it is legitimate?

Jumping in to help you get the information you need, jrodriguez-actiu.

You can use the Audit Log report to check the name of the user who added the app. Let me share the steps on how you can run the report. 

This report also tracks and gives you the following details:

• The date of any change to your books
• The name of the user who made the change
• The type of change or event
• The name of any customer or vendor related to the change
• Any original transaction date and amount

Here's how to run the report:

1. Go to the Gear icon and select Audit Log.
2. Click the drop-down list in the Date Changed section and select Custom.
3. Enter last weekend's date and select All Users in the User section.
4. Look for any changes that says "Added" in the Event column.
5. The name of the user who connected it is indicated the User column.
6. Click the View link under the History column to see more details when and who added the app.

Check out this article for more details about this feature:

• Use the Audit Log in QuickBooks Online
• Apps that Work With QuickBooks Online

To check if the app is legitimate, go to the this link and search for the name of the app: https://quickbooks.intuit.com/app/apps/home/.

Let me also share these articles for more guidance when managing apps in the program: 

• Disconnect an App and Change Subscription
• Finding an App's Error Log

Don't hesitate to keep me posted if you're able to identify the name of the user. You can also get back here and ask follow-up questions if you need anything else.