Which application types are not provided by IT but are allowed with restrictions because of their business benefits?

Unsanctioned applications are typically used without IT approval and are often considered high-risk, usually blocked or actively discouraged due to security and compliance concerns.

Monitored is an action taken by IT to observe application usage or behavior, rather than a classification of an application's allowance status itself.

Tolerated applications represent a middle ground in application governance where IT acknowledges their presence and value to business units, allowing their use under specific controls or monitoring to manage associated risks without providing full IT support or endorsement.

Sanctioned applications are fully approved, supported, and often provisioned by IT, meaning they align with organizational policies and do not carry the connotation of being allowed 'with restrictions because of their business benefits'.