Defender for Cloud Apps App Governance Access Change: Fix Cloud Application Administrator Roles by September 26

Microsoft Defender for Cloud Apps is retiring App Governance support for the Cloud Application Administrator role on September 26, 2026, two days from this writing. If any of your Defender admins were relying solely on that role to manage App Governance, they lose access the moment this lands, with no grace period built in beyond the retirement date itself. Review role assignments now, not after someone reports they can no longer see the App Governance blade.

What’s actually changing

Microsoft is updating which Microsoft Entra roles grant access to App Governance (the component of Defender for Cloud Apps that monitors and governs OAuth-connected third-party applications) when Unified Role-Based Access Control (URBAC) is enabled for Defender for Cloud Apps. As part of that update, support for the Cloud Application Administrator role specifically is being retired for App Governance access. Administrators whose only relevant role assignment is Cloud Application Administrator will no longer be able to access App Governance once URBAC is enabled and this retirement takes effect, they’ll still hold the role, it simply stops granting this specific access.

Microsoft frames this as aligning App Governance access with the standard supported role set already used across other Defender services, and as groundwork for future role-based access enhancements, this isn’t an isolated App Governance decision, it’s part of a broader consistency push across the Defender product family’s access model.

Who’s actually affected

This only matters for organizations that have URBAC enabled for Defender for Cloud Apps, if URBAC isn’t enabled in your tenant, this specific change doesn’t apply yet, though it’s worth understanding ahead of eventually enabling URBAC. For tenants with URBAC enabled, any administrator whose App Governance access currently comes exclusively through the Cloud Application Administrator role, without an additional supported role like Security Administrator, loses that access on September 26.

What to do before the deadline

# Review current Cloud Application Administrator role assignments
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq 'CloudAppAdminRoleId'" |
    Select-Object PrincipalId, DirectoryScopeId

# Cross-reference against who actually needs App Governance access specifically,
# versus who was assigned Cloud Application Administrator for other reasons
# entirely and happened to get App Governance access as a side effect

For every administrator who genuinely needs continued App Governance access, add a supported role, Security Administrator is the role Microsoft specifically calls out as continuing to work, rather than assuming Cloud Application Administrator alone will keep working through some grace period. Do this via the Microsoft Entra admin center under Roles and administrators, or via Microsoft Graph PowerShell for bulk reassignment across multiple admins. Confirm the change actually took effect by having an affected admin verify they can still reach the App Governance blade before the deadline, not just that the role assignment was made.

Why this deserves attention beyond a routine role tweak

Role-based access changes in security tooling specifically have a way of causing quiet, delayed-discovery problems: nothing breaks loudly on the day of the change, an admin just quietly loses visibility into OAuth app governance and may not notice until they specifically need to investigate a suspicious third-party app connection and can’t get into the console to do it. Given App Governance’s actual job, catching malicious or overly-permissioned OAuth app grants, is itself a security-relevant control, losing quiet access to it at exactly the wrong moment is a real operational risk, not just an inconvenience.

Frequently asked questions

Does this affect Defender for Cloud Apps entirely, or just the App Governance portion?
Just App Governance specifically. Other Defender for Cloud Apps functionality and its associated role requirements aren’t affected by this particular retirement, confirm your specific admins’ broader Defender for Cloud Apps access separately if you have concerns beyond App Governance.

We don’t have URBAC enabled for Defender for Cloud Apps. Do we need to act before September 26?
Not for this specific change, since it only applies once URBAC is enabled. It’s still worth reviewing your Cloud Application Administrator assignments now regardless, so that whenever your organization does enable URBAC, whether that’s a planned near-term move or further out, you’re not caught by this same gap at that point instead.

Is Security Administrator the only role that continues to grant App Governance access?
Security Administrator is the role Microsoft specifically calls out, but confirm the complete current list of supported roles directly against Microsoft’s official documentation for Defender for Cloud Apps role management, since Microsoft may define more than one supported role and that list is exactly the kind of detail worth verifying against the primary source rather than assuming from a single example.