To create inline policies that are meant to block risky activities in Unsanctioned/non-IT purchased apps, follow the steps as shown below:
- Navigate to Policies > Real time Protection > New Policy > Cloud App access.
- Under the ‘Destination’ section, select the ‘Category’ option. Add the list of categories that should be checked for risky activities in unsanctioned applications.
- Under ‘Add Criteria and Constraints’, select the option ‘App tag’ and select the value ’Unsanctioned’.
- Under Activities and constraints, select the ‘Edit’ button to select the list of specific activities that need to be blocked.
The policy results can be seen in Skope IT > Alerts by selecting filters ‘Action eq block’ and ‘Alert_type eq Policy’.
To learn more: Real-time Protection Policies