Unsanctioned app shows data usage

[andy-1115]

Hi everyone, I've been using MCAS for a while with no issue but last week one user / device appeared at the top of the dashboard data usage list.  Does anyone know how / why a unsanctioned app would allow data download?  I appreciate that issues with the policy, defender and or smartscreen could allow users to bypass, but not sure why the app still shows as "unsanctioned" (Red) yet allowed data download.

Regards, A

[#2]

Hi andy-1115,

That is the expected behavior unless you have integrated MDCA, formerly MCAS with Defender for Endpoint. See this link for details.https://docs.microsoft.com/en-us/defender-cloud-apps/mde-integration

You will see in the link above link that there is an "enforce app access" tick box.

Thanks, Ash

[#3]

Hi Ash_Gardiner,

Thanks the quick response and sorry for delay in my reply but I've been away. Understand, and double checked that the "enforce app action" is and was enabled. I'm struggling to replicate this now as the unsanctioned app gets blocked as expected. As i mentioned i've had this working for months without issue, web content filters are working ok and unsanctioned apps were getting blocked also. Just notice this one device last week and can't figure it out. If i ever get to the bottom of it I'll post an update. Thanks again.