# Conditional Access policies should not use the deprecated Approved Client App grant

Checks if the tenant has no Conditional Access policy that requires an approved client app.

Source: https://maester.dev/docs/tests/MT.1072

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/henrikpiecha" title="Henrik Piecha · Original author"><img src="https://github.com/HenrikPiecha.png" alt="Henrik Piecha" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/henrikpiecha">Henrik Piecha</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Conditional Access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1072
```

## Overview

Checks if the tenant has no Conditional Access policy that requires an approved client app.

The approved client app grant is retiring in early March 2026. Organizations must transition all current Conditional Access policies that use only the Require Approved Client App grant control to Require Approved Client App or Application Protection Policy by March 2026. Additionally, for any new Conditional Access policy, only apply the Require application protection policy grant.

After March 2026, Microsoft will stop enforcing require approved client app control, and it will be as if this grant isn't selected. Use the following steps before March 2026 to protect your organization’s data.

## Learn more

- [Migrate approved client app to application protection policy in Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/migrate-approved-client-app)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1072 |
| Severity | High |
| Suite | Maester |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | ConditionalAccessPolicy |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3 |
| PowerShell test | [Test-MtCaApprovedClientApp](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1072.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1072.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1072.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1072.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1072.md)