Microsoft Defender for Cloud Apps

Cloud discovery policies

4 September 2026Doc update+11 / −5 lines

In brief

The article now explains that selecting “Tag app as unsanctioned” automatically blocks access when the policy matches, and defines app tags as labels for filtering and targeting discovered apps.

What Defender admins need to know

Administrators can more clearly understand the blocking effect and use of app tags when configuring discovery policies.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create cloud discovery policies in Defender for Cloud Apps

1. Select **Daily traffic** greater than 2,000 GB (or other).

Configure governance actions to be taken when an alert is triggered. Under Governance, select Tag app as unsanctioned.
~~Access to the app will be automatically blocked when the policy is matched.~~
~~Optional: Apply Defender for Cloud Apps native integrations~~

Optional: Apply Defender for Cloud Apps native integrations with Secure Web Gateways to block app access.

Create an unsanctioned app discovery policy

App tags are labels you assign to discovered apps so you can filter and target them in discovery policies. Perform the following steps to detect use of unsanctioned business apps.

In the Cloud app catalog, search for your business-ready apps and mark them with a custom app tag.
Add an App tag filter and choose the app tags you created for your business-ready apps.
Configure governance actions to be taken when an alert is triggered. Under ~~Governance,~~Governance, select Tag app as unsanctioned.
~~Access to the app will be automatically blocked when the policy is matched.~~
~~Optional: Use Defender for Cloud Apps native integrations~~

Optional: Use Defender for Cloud Apps native integrations with Secure Web Gateways to block app access.

@@ -1,11 +1,11 @@ --- title: Cloud discovery policies  description: Get started with cloud discovery in Defender for Cloud Apps to gain visibility into Shadow IT and analyze cloud app usage across your organization.-ms.date: 06/16/2026+ms.date: 07/03/2026 ms.topic: how-to ms.reviewer: Mravela ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Create cloud discovery policies in Defender for Cloud Apps @@ -66,7 +66,10 @@ Perform the following steps to create a policy that detects risky or non-complia      1. Select **Daily traffic** greater than 2,000 GB (or other). -1. Configure governance actions to be taken when an alert is triggered. Under **Governance**, select **Tag app as unsanctioned.**<br />Access to the app will be automatically blocked when the policy is matched.+1. Configure governance actions to be taken when an alert is triggered. Under **Governance**, select **Tag app as unsanctioned.**++    > [!IMPORTANT]+    > Selecting **Tag app as unsanctioned** automatically blocks access to the app when the policy is matched.  1. Optional: Apply [Defender for Cloud Apps native integrations](set-up-cloud-discovery.md) with Secure Web Gateways to block app access. @@ -82,7 +85,7 @@ You can detect when your employees continue to use unsanctioned apps as a replac  ### Create an unsanctioned app discovery policy -Perform the following steps to detect use of unsanctioned business apps.+App tags are labels you assign to discovered apps so you can filter and target them in discovery policies. Perform the following steps to detect use of unsanctioned business apps.  1. In the Cloud app catalog, search for your business-ready apps and mark them with a [custom app tag](discovered-app-queries.md#creating-and-managing-custom-app-tags). @@ -90,7 +93,10 @@ Perform the following steps to detect use of unsanctioned business apps.  1. Add an **App tag** filter and choose the app tags you created for your business-ready apps. -1. Configure governance actions to be taken when an alert is triggered. Under Governance, select **Tag app as unsanctioned**.<br />Access to the app will be automatically blocked when the policy is matched.+1. Configure governance actions to be taken when an alert is triggered. Under **Governance**, select **Tag app as unsanctioned**.++    > [!IMPORTANT]+    > Selecting **Tag app as unsanctioned** automatically blocks access to the app when the policy is matched.  1. Optional: Use [Defender for Cloud Apps native integrations](set-up-cloud-discovery.md) with Secure Web Gateways to block app access.