Managing Sanctioned Apps

Updated 35 minutes ago by admin

Identifying which SaaS applications your organisation should allow is an important step in securing your environment and controlling Shadow IT/AI.

The Sanctioned App condition is available with Cloud Application Security (CASB) and is enforced through rules in the Rule Builder. It lets you distinguish between applications that are explicitly approved and those that are not, so you can enforce policies that control access and reduce risk.

Setting an app as Sanctioned

Setting an app as Sanctioned marks it as approved for use in your rules, so they can treat the application as trusted and apply policies accordingly.

  1. In the console, go to Browse ⟶ SaaS Catalog.
  2. Search for the app by name, or find it in the category tree on the left.
  3. Click the circle to the right of the app name. It turns green with a tick when the app is sanctioned.
  4. Repeat for any other apps you want to mark as sanctioned.
Click an app's name to see the actions tracked for it, with their baseline risk. Use Sanctioned Only at the top of the catalog to list just the apps you have sanctioned.

Controlling Sanctioned & Unsanctioned Apps

Once at least one app is sanctioned, you can apply controls to sanctioned apps, or to apps that are not on your sanctioned list.

  1. Go to Browse ⟶ Rule Builder.
  2. Create a new rule (Create Rule) or open an existing one.

To allow all traffic to Sanctioned Apps:

  1. In the Toolbox, double-click Sanctioned App (or drag it onto the Conditions column).
  2. Click the settings icon on the tile and tick some or all of the apps you have sanctioned. Use All to select every sanctioned app, or Manage to open the SaaS Catalog.
  3. Add the Allow action to the Actions column.
  4. Position the rule above any rules that block app activity, so your allow rule for sanctioned apps is processed first.
  5. User actions in your sanctioned apps will be allowed, and the activity is recorded in Analytics ⟶ SaaS Activity.

To block all traffic to Unsanctioned Apps:

  1. Add the Sanctioned App condition and configure it by selecting all of the available apps (All).
  2. Click the Enable inverse match (NOT) icon on the tile, so it matches apps that are not sanctioned. A red NOT label appears. (This replaces Switch Logic in the old dashboard.)
  3. Add the Block action, click its settings icon and choose the block page template to show.
  4. Position the rule after any rules that allow sanctioned apps, so the rules don't conflict.
  5. User actions in any SaaS Catalog app will now be blocked unless the app is sanctioned.
The Sanctioned App condition targets user-generated actions. It is not intended to block at domain level. To block an app's entire domain(s), use a Custom URL category (Browse ⟶ Categories ⟶ Custom URL).

Reviewing App Usage

  1. Go to Analytics ⟶ SaaS Activity, choose a timespan and click Run Report.
  2. To show only sanctioned or unsanctioned activity, expand Filters and use Sanctioned Status ⟶ Status.
The Sanctioned App condition works like any other condition: other rules and conditions can override it, depending on rule order. An app may not get the expected designation if a higher-priority rule matches it first and stops processing.
Apps show as Unsanctioned if they are not used in at least one rule with the Sanctioned App condition.

In Analytics ⟶ SaaS Activity, the Sanctioned column shows a shield icon for each request. Hover over the icon to see its designation.

Designation

Description

Sanctioned (green shield with a tick)

The application is approved for use and complies with company security policies.

Sanctioned Exception (amber shield)

The application is approved, but a policy exception or NOT (inverse) match is affecting how it is evaluated. Review the rule configuration for details.

Unsanctioned (red shield with a cross)

The application is not approved and may present a security or compliance risk. Consider adding the app to your rules.

How did we do?