How can I find out who Unsanctioned an app in defender

Question

How can I find out who Unsanctioned an app in defender

Klotz, Mark CTR (FAA) 0

Needing to see who unsanctioned an app as it generated a incident for our team but we weren't aware change made. Appears it happened during gov shutdown but we would like to know for future.

Catherine Kyalo 2,620 Reputation points Microsoft Employee

2025-11-25T15:19:39.1733333+00:00

You can explore https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview, specifically, have you tried the the Cloud Events table and filter on the "IsAdminOperation"

1 answer

Your answer

Catherine Kyalo 2,620 Reputation points Microsoft Employee

2025-11-25T15:19:39.1733333+00:00

You can explore https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview, specifically, have you tried the the Cloud Events table and filter on the "IsAdminOperation"

Answer 1

Klotz, Mark CTR (FAA) 0

Rejected, it isn't clear on endpoint that an app got unsanctioned, only blocked so no reference to a change in Cloud Apps access. I would like to know who did the change or is there a listing or log that would tell me?

Share via

How can I find out who Unsanctioned an app in defender

1 answer

Your answer