Block risky activities to Unsanctioned/non-IT purchased apps

To create inline policies that are meant to block risky activities in Unsanctioned/non-IT purchased apps, follow the steps as shown below:

Navigate to Policies > Real time Protection > New Policy > Cloud App access.
Under the ‘Destination’ section, select the ‘Category’ option. Add the list of categories that should be checked for risky activities in unsanctioned applications.
Under ‘Add Criteria and Constraints’, select the option ‘App tag’ and select the value ’Unsanctioned’.
Under Activities and constraints, select the ‘Edit’ button to select the list of specific activities that need to be blocked.

The policy results can be seen in Skope IT > Alerts by selecting filters ‘Action eq block’ and ‘Alert_type eq Policy’.