Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud Apps
Cloud and workloads

App Governance App Policies Create

29 September 2026New feature+18 / −21 lines

In brief

The documentation adds Risk management templates, including New high risk app and Risk score policies with customizable risk thresholds. It also updates monitoring guidance and the navigation path.

What Defender admins need to know

Administrators can use risk-based templates to generate alerts for high-risk apps. No configuration change or migration is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

To create a new app policy based on an app policy template, on the Choose App policy template page, select a category of app template, select the name of the template, and then select Next.

App policy templates are grouped into these categories: Usage, Permissions, Risk management, and Certification.

Usage-based app policy templates

| New highly privileged app | Find newly registered apps that have been granted write access and other powerful permissions to Microsoft Graph and other common Microsoft first-party APIs. This policy checks the following conditions:
- Registration age: Seven days or less (customizable) | | New app with non-Graph API permissions | Find newly registered apps that have permissions to non-Graph APIs. These apps can expose you to risks if the APIs they access receive limited support and updates. This policy checks the following conditions:
- Registration age: Seven days or less (customizable)
- Non-Graph API permissions: Yes |

Risk management based app policy templates

The following table lists the app governance templates supported to generate alerts based on app risk.

Template nameDescription
New high risk appFind newly registered apps that have a high risk. This policy checks the following conditions:
- Registration age: Seven days or less (customizable)
- Risk score: Greater than 70 (customizable)

Certification-based app policy templates

The following table lists the app governance templates supported to generate alerts for Microsoft 365 certification. | Condition | Condition values accepted | Description | More information | | --- | --- | --- | --- | | Registration age | Within last X days | Apps that were registered to Microsoft Entra ID within a specified period from the current date | | | Risk score | Greater than X | Apps with a risk score greater than the specified value | | | Certification | No certification, Publisher attested, Microsoft 365 Certified | Apps that are Microsoft 365 Certified, have a publisher attestation report, or neither | Microsoft 365 Certification framework overview | | Publisher verified | Yes or No | Apps that have verified publishers | Publisher Verification | | Application permissions (Graph only) | Select one or more API permissions from list | Apps with specific Graph API permissions that have been granted directly | Microsoft Graph permissions reference | 9. On the Define Policy Actions page, select Disable app if you want app governance to disable the app when an alert based on this policy is generated, and then select Next. Use caution when applying actions because a policy may affect users and legitimate app use. 10. On the Define Policy Status page, select one of these options:

- **Audit mode**: Policies are evaluated but configured actions won't occur. Audit mode policies appear with the status of **Audit** in the list of policies. You should use Audit mode for testing a new policy.
- **Active**: Policies are evaluated and configured actions will occur.
- **Inactive**: Policies aren't evaluated and configured actions won't occur.
  1. Carefully review all parameters of your custom policy. Select Submit when you're satisfied. You can also go back and change settings by selecting Edit beneath any of the settings.

Test and monitorMonitor your new app policy

Now that yourAfter you create an app policy is created, you shouldpolicy, monitor it on the Policies page to ensureconfirm that it's registering an generates the expected number of active alerts and total alerts during testing.alerts.

Screenshot of the app governance policies summary page in Microsoft Defender XDR, with a highlighted policy.

If the number of alerts is an unexpectedly low value, edit the settings oflow, review and update the app policy to ensure you've configured it correctly before setting the policy status.settings.

Here's an example of a process for creating a new policy, testing it, and then making it active:

  1. Create the new policy with severity, apps, conditions, and actions set to initial values and the status set to Audit mode.

  2. Check for expected behavior, such as alerts generated.

  3. If the behavior isn't expected, edit the policy apps, conditions, and action settings as needed and go back to step 2.

  4. If the behavior is expected, edit the policy and change its status to Active.

    For example, the following flow chart shows the steps involved:

    Screenshot illustrating the steps involved in the create app policy workflow.

Create a new policy for OAuth apps connected to Salesforce and Google Workspace

To create a new app policy for Salesforce, Google and other apps:

  1. GoIn Microsoft Defender XDR, go to Microsoft Defender XDRCloud Apps > App governance > Policies > Other apps. For example:

    Screenshot of the Other apps policy creation page in App Governance

  2. Filter the apps according to your needs. For example, you might want to view all apps that request Permission to Modify calendars in your mailbox.