User Risk: App Usage Policies

• Overview
• Policy options
• Rules of engagement
• Update the organization's default policy
• Update an app's base rule
• Create custom rules
• Bulk-update app usage policies

Overview

App usage policies define how (or if) your users can engage with individual applications. How app usage policies work:

• Every app must have an assigned app usage policy. Apps can have one of four base policies: approved, tolerated, nudged, or blocked.
• Default app rule. An organization-wide default policy ensures every app has a policy. This policy is set to ‘tolerate’ by default, but you can update it.
• Base rules. Override the default policy by updating an app’s base policy. Set base rules to the policy that applies to the most (or all) users.
• Custom rules. Give individual teams or roles more or less access to apps as needed. Ex: If only your Finance team should have access to Xero, set the app's base rule to blocked and then create a custom rule that approves Xero for the Finance team.

UpGuard's browser extension enforces policies in real time so the experience users see in the browser matches what's been set in UpGuard.

App usage policy options

You must be an admin, or have admin rights, in UpGuard to update app usage policy.

All apps must have a base rule applied, the table below shows what each policy means and what users experience in the browser.

If applicable, browser defense policies (block file uploads and copy/paste, personal OAuth login restriction, and password detection) layer on top of these outcomes.

Rules of engagement: policies

Organization defaults, base rules, and custom rules allow you to create a strong default policy while still giving everyone the exact access they need.

🧠 Apps that have been admin-consented through Microsoft Entra are automatically assigned an Approved policy in UpGuard. New base rules and custom rules can’t be applied within UpGuard, to change app access, manage permissions in Entra.

Update the organization's default policy

Update the organization’s default policy to update the policy applied to all new apps, and all apps currently using the org’s default policy.

1. Click the Settings (gear) icon in UpGuard's upper right-hand corner.
2. Click Policies under User Risk in the left panel.
3. In the Organization default policy section, click the pencil icon next to the current default policy.
4. Select the new policy.
5. Click Save.
6. A confirmation modal appears, it tells you how many apps will be impacted by the change.
7. Click Update.

User Risk’s browser UI immediately updates and new apps detected after this change immediately inherit the new default policy. Your user’s browser extensions will update within an hour.

Update an app's base policy

Update an app’s base policy to assign it a policy different from the organization’s default. Set an app’s base rules to the policy that applies to the most (or all) users.

1. Click the User Risk icon from UpGuard’s left-hand navigation.
2. Click Applications.
3. Click the app whose policy you want to update.
4. Click Manage usage policy in the page’s upper-right corner.
5. Click the pencil icon next to the app’s current base rule.
6. Select the new policy.
7. (Optional) Add custom rules for specific teams or roles.
8. Review the Impact preview sidebar on the right side of the manage-policy page to see how many current users will fall into each outcome or if users match multiple custom rules.
9. Click Update usage policy.
10. (optional) Add a note explaining why you made the change(s) — this will help if reviewing settings later.
11. Click Save.

User Risk’s browser UI immediately updates and your user’s browser extensions will update within an hour.

Create custom rules

Use custom rules to override the app’s base rule for specific teams or roles. Example: block an app for the whole organization (base rule) but approve it for the team that needs it (custom rule).

1. User Risk > Applications > select an application.
2. Click Manage usage policy.
3. Scroll to the Custom rule section under the base rule. To assign a policy to a team or role, you’ll find the outcome you want them to have and add the team or role to it.
4. Click the pencil icon next to the appropriate policy.
5. Click the dropdown next to Roles or Teams to create an exception for that group.
6. (Optional) Repeat steps 4 and 5 for additional rules you want to create for this app.
7. Click Update usage policy at the bottom of the page.

A given team or role can only be assigned to one custom rule per app. Teams and roles that are already assigned to a different rule are greyed out in the dropdowns.

Bulk-update app usage policies

Use bulk updates to change multiple app’s base rule at the same time or to add, remove, or edit attributes.

1. User Risk > Applications
2. Click the checkboxes next to the apps you want to update.
3. In the action bar at the bottom of the page, click
1. Manage usage policy and click the outcome you want to apply (Approve, Tolerate, Nudge, or Block).
2. Manage attributes and add label(s) and value(s). To remove attributes, simply leave the modal blank.
4. Click Update or Save.