Security Policy Errors

How to Bulk Unsanction Generative AI Apps in Microsoft Defender

Maira Mehtab Sep 22, 2026 869 views

Question details

The user needs to find a way to bulk-change the sanction status of Generative AI applications with risk scores from 0 to 7 to Unapproved within Microsoft Defender for Cloud Apps.

Product: Microsoft Defender for Cloud Apps
Device & OS: not provided
Scenario: Administrators want to automate the restriction of low-score Generative AI applications to enforce organizational security policies.
Observed behavior: The user requires a verified PowerShell script or method to filter and unsanction these apps, as the suggested DefenderCloudAppSecurity package could not be found or validated.

Before you start

Ensure you have global administrator or security administrator permissions in your Microsoft 365 tenant and a safe sandbox environment to test custom PowerShell scripts before running them in production.

Solution 1Recommended

Use a Custom PowerShell Script via Microsoft Graph API

Since community PowerShell packages may be unverified, using official API endpoints through a custom script is the safest way to filter and unsanction apps.

A script can be configured to filter applications categorized as Generative AI that have a risk score of 7 or lower. Once identified, the script changes their sanction state to Unapproved.

Because unofficial modules like DefenderCloudAppSecurity may fail or lack validation, utilizing Microsoft Graph API endpoints or officially supported Cloud App Security modules is highly recommended.

Open PowerShell

Launch Windows PowerShell with Administrator privileges on your machine.

Connect to Cloud App Security

Authenticate to your Microsoft Defender for Cloud Apps environment using an active API token and the appropriate connection cmdlet.

Filter Applications

Write a query command to retrieve apps where the category matches 'Generative AI' and the risk score is less than or equal to 7.

Apply Unapproved Status

Use a Foreach loop to iterate through the filtered app list and execute the command to set the sanction status to 'Unapproved' for each app.

Verify Changes

Log into the Microsoft Defender portal and navigate to the Cloud app catalog to confirm that the selected Generative AI apps now show as Unsanctioned.

Testing is Crucial: Always validate custom cmdlets and test your PowerShell script in a non-production environment carefully, as bulk operations cannot be easily undone.

Solution 2

Consult the Microsoft Defender Community

Seek authoritative guidance and validated script templates from Microsoft specialists when official documentation lacks specific bulk-action commands.

Free Microsoft Office alternative

Looking for a Secure and Free Office Suite? Try WPS Office

While you configure advanced security policies and manage cloud applications in Microsoft Defender, ensuring your team has a reliable and secure office suite is just as important. WPS Office provides a robust, lightweight, and completely free alternative to Microsoft Office.

1. Download the Installer: Navigate to the official WPS Office website and click the free download button for your operating system.
2. Install the Software: Run the downloaded executable file and follow the standard installation prompts.
3. Edit Your Documents: Open WPS Office and instantly access or edit your existing Microsoft Office files without losing any formatting.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsLightweight installation ensures fast performance on any desktop or mobile deviceBuilt-in advanced PDF editing, converting, and merging toolsEnterprise-grade document encryption protects your sensitive offline filesFamiliar user interface eliminates the learning curve for smooth enterprise migration

microsoft office alternative - wps office

Frequently Asked Questions

Can I bulk unsanction apps directly from the Microsoft Defender portal UI?

The Defender for Cloud Apps portal allows you to manually tag individual apps or apply bulk actions to selected items in the Cloud app catalog. However, applying complex logical filters (like specific risk score ranges for a specific category) automatically generally requires API integration or PowerShell scripting.

What happens when an application is marked as Unsanctioned?

When an app is marked as Unsanctioned (Unapproved), Defender for Cloud Apps monitors its usage and generates alerts. If your tenant is integrated with Microsoft Defender for Endpoint or a supported Secure Web Gateway, user access to that unsanctioned application will be blocked network-wide.

Why might a PowerShell package for Defender Cloud Apps fail to be verified?

Community-created or unofficial PowerShell modules may lack Microsoft validation, use deprecated API endpoints, or simply be removed from public repositories. It is highly advised to rely strictly on official Microsoft Graph API calls for security-related automation.

How are risk scores determined in Defender for Cloud Apps?

Microsoft evaluates thousands of cloud applications against over 90 risk factors, including regulatory certifications, industry standards, and security protocols. The resulting score ranges from 1 to 10, with lower scores indicating a higher security risk.

Microsoft Office Security Issues