Applications

Tier 1 Checks

#	Check	License
A01	Shadow IT discovery is enabled to inventory unsanctioned cloud apps	MDCA / E5
A02	Risky OAuth apps are reviewed and an OAuth app policy is configured	MDCA / E5
A03	App governance is enabled for OAuth apps accessing Microsoft 365 data	MDCA add-on / E5
A04	Users cannot register applications by default	—
A05	User consent to apps is restricted and admin consent workflow is enabled	—
A06	Conditional Access App Control governs sessions for sensitive apps	P1 + MDCA

Tier 2 / Tier 3 coverage

This is Tier 1 — the highest-impact starting set for app governance. Tier 2 and Tier 3 add depth on app connector onboarding for API-level monitoring, custom OAuth app policies and automated remediation, anomaly-detection policies, file policies for sanctioned apps, and Conditional Access App Control session policies (download blocking, label-aware DLP, read-only enforcement) across the full app estate.