Forum Discussion

andy-1115's avatar
andy-1115
Copper Contributor
Jun 06, 2022

Unsanctioned app shows data usage

Hi everyone, I've been using MCAS for a while with no issue but last week one user / device appeared at the top of the dashboard data usage list.  Does anyone know how / why a unsanctioned app would allow data download?  I appreciate that issues with the policy, defender and or smartscreen could allow users to bypass, but not sure why the app still shows as "unsanctioned" (Red) yet allowed data download.

 

Regards, A

 

 

2 Replies

  • Ash_Gardiner's avatar
    Ash_Gardiner
    Iron Contributor
    Jun 06, 2022
    Hi andy-1115,

    That is the expected behavior unless you have integrated MDCA, formerly MCAS with Defender for Endpoint. See this link for details.https://docs.microsoft.com/en-us/defender-cloud-apps/mde-integration

    You will see in the link above link that there is an "enforce app access" tick box.

    Thanks, Ash
    • andy-1115's avatar
      andy-1115
      Copper Contributor
      Jun 10, 2022
      Hi Ash_Gardiner,

      Thanks the quick response and sorry for delay in my reply but I've been away. Understand, and double checked that the "enforce app action" is and was enabled. I'm struggling to replicate this now as the unsanctioned app gets blocked as expected. As i mentioned i've had this working for months without issue, web content filters are working ok and unsanctioned apps were getting blocked also. Just notice this one device last week and can't figure it out. If i ever get to the bottom of it I'll post an update. Thanks again.

Resources