azureblog.co.uk
← cd ~/licences
// licences · sku

Microsoft_Cloud_App_Security_App_Governance_Add_OnApp governance add-on to Microsoft Defender for Cloud Apps

Microsoft_Cloud_App_Security_App_Governance_Add_On is the SKU part number Microsoft uses for App governance add-on to Microsoft Defender for Cloud Apps. You'll see it in Graph, PowerShell, licence reports and group-based licensing errors.

Product nameApp governance add-on to Microsoft Defender for Cloud Apps
String ID (SkuPartNumber)Microsoft_Cloud_App_Security_App_Governance_Add_On
GUID (SkuId)9706eed9-966f-4f1b-94f6-bb2b4af99a5b
Service plans3

Service plans included (3)

Service planNameID
M365_AUDIT_PLATFORMMicrosoft 365 Audit Platformf6de4823-28fa-440b-b886-4783fa86ddba
MICROSOFT_APPLICATION_PROTECTION_AND_GOVERNANCE_AMicrosoft Application Protection and Governance (A)5f3b1ded-75c0-4b31-8e6e-9b077eaadfd5
MICROSOFT_APPLICATION_PROTECTION_AND_GOVERNANCE_DMicrosoft Application Protection and Governance (D)2e6ffd72-52d1-4541-8f6c-938f9a8d4cdc

Is it in your tenant?

powershell3 lines
Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "Microsoft_Cloud_App_Security_App_Governance_Add_On" |
    Select-Object SkuPartNumber, ConsumedUnits, @{ n = "Purchased"; e = { $_.PrepaidUnits.Enabled } }

Assign it to a user

For more than a handful of people, use group-based licensing instead. The user needs a usage location set first.

powershell3 lines
Connect-MgGraph -Scopes "User.ReadWrite.All"
Set-MgUserLicense -UserId "jane.doe@contoso.com" `
    -AddLicenses @{ SkuId = "9706eed9-966f-4f1b-94f6-bb2b4af99a5b" } -RemoveLicenses @()

Who has it?

powershell4 lines
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq 9706eed9-966f-4f1b-94f6-bb2b4af99a5b)" `
    -ConsistencyLevel eventual -CountVariable n -All |
    Select-Object DisplayName, UserPrincipalName

Search all 620 SKUs →

Sources