Merge pull request #5253 from MicrosoftDocs/main

[AutoPublish] main to live - 10/13 04:28 PDT | 10/13 16:58 IST

Author: m365-skilling-repo-management[bot]

defender-for-cloud-apps/governance-discovery.md

@@ -1,17 +1,24 @@
 ---
 title: Govern discovered apps 
 description: This article describes the procedure for governing your discovered apps by blocking their usage in your organization.
-ms.date: 01/29/2023
+ms.date: 09/30/2025
 ms.topic: how-to
 ms.reviewer: Mravela
 ---
 
 # Govern discovered apps
 
 
-
 After you review the list of discovered apps in your environment, you can secure your environment by approving safe apps (**Sanctioned**) or prohibiting unwanted apps (**Unsanctioned**) in the following ways.
 
+## Prerequisites
+
+Before you can block discovered cloud apps, you must meet the following requirements:
+
+- [Turn on **Cloud Protection** in Microsoft Defender for Endpoint](/defender-endpoint/enable-cloud-protection-microsoft-defender-antivirus)
+- [Turn on **Network Protection** in Microsoft Defender for Endpoint.](/defender-endpoint/network-protection#required-browser-configuration)
+- Install the **Microsoft Defender Browser Protection** add-on across all non-Microsoft browsers in your organization.
+
 ## Sanctioning/unsanctioning an app
 
 You can mark a specific risky app as unsanctioned by clicking the three dots at the end of the row. Then select **Unsanctioned**. Unsanctioning an app doesn't block use, but enables you to more easily monitor its use with the cloud discovery filters. You can then notify users of the unsanctioned app and suggest an alternative safe app for their use, or [generate a block script using the Defender for Cloud Apps APIs](api-discovery-script.md) to block all unsanctioned apps.