Forum Discussion
Disable Defender for Cloud Apps alerts
Hi VolkerRacho,
Here are steps to disable these alerts:
For a tenant-wide disable, navigate to MDE > Defender for Cloud Apps > Discovery > Discovered Apps and set the specific app to "Sanctioned".
To disable alerts for a specific Device Group, go back to the MDE > Defender for Cloud Apps > Discovery > Discovered Apps section, set the app to "Unsanctioned," and when the "Tag as unsanctioned?" dialog box appears, select the specific Device Group.
help.redcanary.com
Manage security alerts - Microsoft Defender for Cloud | Microsoft Learn
Control cloud apps with policies - Microsoft Defender for Cloud Apps | Microsoft Learn
Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.
If the post was useful in other ways, please consider giving it Like.
Kindest regards,
Leon Pavesic
(LinkedIn)
Changing the sanctioned status of an app edits if the app is blocked or not. I think OP wants to keep the app unsanctioned/blocked, but does not want to get alerted on every occasion where a user visits the URL.
Hi,
Yes, you’re right — I’m facing the same challenge and looking for a solution as well. I want to keep the application marked as unsanctioned or blocked, but I don’t want an alert to be triggered every time someone accesses it. These frequent alerts are creating a lot of noise and impacting visibility.
Could you please let me know if there’s any available fix or alternative approach to handle this scenario?
I’ve already reviewed the following articles for reference:
https://learn.microsoft.com/en-us/defender-cloud-apps/governance-discovery
https://techcommunity.microsoft.com/blog/microsoft-security-blog/block-access-to-unsanctioned-apps-with-microsoft-defender-atp--cloud-app-securit/1121179
Thanks,
Aditya Beniwal
