App Governance in Microsoft 365

App Governance is a Microsoft 365 security add-on that provides advanced monitoring, policy enforcement, and remediation for apps that use Microsoft Graph APIs. It addresses the growing risk of OAuth applications that have been granted permissions to access organizational data. Unlike basic app consent policies in Microsoft Entra ID, App Governance offers continuous monitoring and automated responses based on app behavior patterns.

The service is available as an add-on for Microsoft 365 E5, Microsoft 365 E5 Compliance, Microsoft 365 E5 Security, and Microsoft 365 E5 Information Protection and Governance. It can also be purchased as a standalone SKU. The exam expects you to know which licenses include App Governance.

App Governance operates by collecting telemetry from Microsoft Graph API calls made by apps. The data includes:

This telemetry is analyzed against a set of built-in and custom policies. When a policy condition is met, an alert is generated, and an optional automated action is taken.

App Governance Policies - Built-in policies: Microsoft provides default policies, such as:

- Unusual increase in app consent - App accessing resources from unusual locations - App with high privilege but low usage - Custom policies: Administrators can create policies based on:

- App characteristics (e.g., publisher, certificate, permissions) - User characteristics (e.g., group membership, risk level) - Behavior patterns (e.g., data access volume, time of day)

Policy Actions - Alert only: Generates an alert in Microsoft 365 Defender - Disable app: Prevents the app from signing in and accessing data - Block app: Completely blocks the app from any activity - Mark as malicious: Flags the app for further investigation

Timers and Defaults - Alert evaluation frequency: Policies are evaluated approximately every 24 hours, but some high-priority alerts are near real-time. - Data retention: Telemetry data is retained for 30 days by default. - Policy auto-remediation: Some built-in policies have a grace period of 7 days before automatic action is taken.

App Governance is managed through the Microsoft 365 Defender portal (https://security.microsoft.com) under App Governance. For automation, you can use PowerShell with the Microsoft Graph PowerShell SDK.

Example: List all apps in App Governance

Connect-MgGraph -Scopes "AppGovernance.Read.All"
Get-MgGovernanceApp -All

Example: Create a custom policy

$policy = @{
    DisplayName = "Block high-risk apps from outside"
    PolicyTemplate = @{
        Id = "custom"
    }
    Conditions = @{
        Applications = @{
            Include = @("*")  # all apps
        }
        Locations = @{
            Include = @("OutsideAllowedLocations")
        }
    }
    Actions = @(
        @{
            ActionType = "BlockApp"
        }
    )
    State = "Enabled"
}
New-MgGovernanceAppPolicy -BodyParameter $policy

Verification - In the Defender portal, navigate to App Governance > Policies to see policy status. - Use Get-MgGovernanceAppPolicy to list policies and their states.

Microsoft Entra ID: App Governance integrates with Microsoft Entra ID for app registration and consent information. It can use Entra ID risk signals (e.g., user risk level) in policies.

Microsoft Defender for Cloud Apps: Defender for Cloud Apps provides OAuth app discovery and governance. App Governance complements it by focusing on Graph API behavior. Both can be used together, but App Governance offers more granular policy options for Graph API usage.

Microsoft 365 Compliance Center: App Governance policies can enforce compliance by blocking apps that access sensitive data without proper controls.

Microsoft Graph API: All telemetry is based on Graph API calls. Apps that do not use Graph API (e.g., legacy protocols) are not monitored by App Governance.

App Governance Roles - Global Administrator: Full access - Security Administrator: Manage policies and view alerts - Security Reader: Read-only access - Compliance Administrator: Manage compliance-related policies - Compliance Data Administrator: Manage data-related policies

Policy Scopes Policies can be scoped to:

Alert Triage Alerts are integrated into the Microsoft 365 Defender incidents. Security analysts can investigate alerts, take actions (disable, block), and provide feedback to improve policy accuracy.

Limitations - App Governance only monitors Graph API calls. Non-Graph traffic (SMTP, IMAP, legacy auth) is not covered. - The service requires that apps are registered in the tenant and have consented permissions. - There is a delay of up to 24 hours for policy evaluation, though some alerts are near real-time.

The MS-102 exam will test:

Be prepared to identify when to use App Governance vs. Defender for Cloud Apps. A common scenario: Defender for Cloud Apps is better for discovering shadow IT OAuth apps, while App Governance is better for monitoring known apps' behavior.

A large enterprise uses a third-party CRM app that has been granted Mail.ReadWrite and Files.ReadWrite.All permissions. The security team wants to ensure the app is not exfiltrating data. They create a custom App Governance policy that triggers if the app accesses more than 10,000 emails in a day or if it accesses files from unusual locations (e.g., outside the corporate IP range). The policy action is set to alert and disable the app if the activity exceeds a threshold. In production, this policy catches an instance where the app's API key was compromised, and an attacker used it to download mail. The app was automatically disabled, and the incident was investigated. Without App Governance, the breach might have gone unnoticed for weeks.

A financial institution requires that any app accessing SharePoint sites containing PII must be vetted. They use App Governance to create a policy that blocks any app that attempts to access a SharePoint site with a sensitivity label of 'Highly Confidential' unless the app is on an approved list. The policy is scoped to all apps and uses the 'Block app' action. This ensures that even if an app receives consent, it cannot access sensitive data without approval. The institution also integrates with Defender for Cloud Apps to discover shadow IT apps, but uses App Governance for granular control over Graph API access.

In a tenant with over 10,000 apps, App Governance can handle the load, but policy evaluation may take longer. Microsoft recommends using scoped policies to limit the number of apps evaluated. The service uses a distributed telemetry pipeline and scales automatically. There is no performance impact on end users or apps.