SaaS Inline tagged/ marker sites discrepancies

1169

Created On 04/14/23 21:58 PM - Last Modified 05/27/25 18:31 PM

SaaS Security API

Enterprise DLP

Prisma SaaS

SaaS Security Inline

Symptom

The marked/tagged sites are seen unsanctioned that were tagged as unsanctioned last year.
The cloud applications count is increased.

The applications that are tagged “sanctioned / unsanctioned / unknown” are limited to 90 days. The applications will be reclassified to the default state after 90 days.
Cloud applications count increase depends on the traffic on the Firewall. Due to this the number of applications keep on changing and this is normal.
Every time a new application is discovered, the default sanctioned status for that application is sanctioned. For example if there is "Seedprod" application status is "unknown" and it reports as "Unknown initially.
User has the option to change the status to sanctioned/unsanctioned/Unknown.
Due to this, one cannot determine the sanctioned status of the application for every user. An application can sanctioned for one user and might be unsanctioned for another user internally. So, it is up to the user to choose the application status based on their company guidelines.

Attached the screenshot and it shows that the total apps for unsanctioned is 28 and might increase later day.