Unsanction SharePoint Subdomain

[stuart townsend]

Hi,

I have been watching the Microsoft Cloud App Security deep dive: Learn how to deploy and manage - BRK3008 session from Ignite last year and the presenter says that you can unsanction subdomains in SharePoint. I have this requirement and wondered if anyone could advise me on how to achieve this as I only want to allow access to the corporate SharePoint online and not any other tenants. I can see in my discovered apps that I have two subdomains but there is not option (three dots) to unsanction one of them. Also, because SharePoint is a connected app it has automatically sanctioned it and there doesn't seem to be a way of unsanctioning the SharePoint online tenant I want to restrict.

Thanks,

Stuart

[#2]

Hi Stuart,

Cloud Discovery currently allows you to mark cloud apps as unsanctioned while per your question it is not supported for specific sub-domains.

Could you please provide some more details on your scenario? Are you looking for marking these Sharepoint instances as unsanctioned in MCAS portal or are there additional use cases?

Thanks,

Danny.

[#3]

Hi Danny,

My scenario is that we have a corporate SharePoint Online domain that I want my users to be able to use, so I want this sanctioned. I then see that there are a couple of other subdomains which I believe are being accessed by other people in the organisation. I don't want these sanctioned. 

If I create a blocking script it seems that I have to sanction SharePoint Online domains, which is what I'm trying to avoid.

Kind regards,

Stuart

[#4 · Accepted solution]

Okay Stuart, thanks for providing this details. I will keep that in mind as part of the product's future plans.
In the meantime, as a workaround I'd suggest to modify the block script, to also include the sub-domains that are used by the instances you wish to unsanction and block based on what is being discovered by MCAS.

Thanks,
Danny.