diff --git a/x-pack/plugins/beats_management/public/bootstrap.tsx b/x-pack/plugins/beats_management/public/bootstrap.tsx
index 4a4d3a893286ba..b5bdd39fa0817e 100644
--- a/x-pack/plugins/beats_management/public/bootstrap.tsx
+++ b/x-pack/plugins/beats_management/public/bootstrap.tsx
@@ -18,10 +18,13 @@ import { BeatsManagementConfigType } from '../common';
 import { MANAGEMENT_SECTION } from '../common/constants';
 
 async function startApp(libs: FrontendLibs, core: CoreSetup<StartDeps>) {
-  const [startServices] = await Promise.all([
-    core.getStartServices(),
-    libs.framework.waitUntilFrameworkReady(),
-  ]);
+  const startServices = await core.getStartServices();
+
+  if (startServices[0].http.anonymousPaths.isAnonymous(window.location.pathname)) {
+    return;
+  }
+  // Can't run until the `start` lifecycle, so we wait for start services to resolve above before calling this.
+  await libs.framework.waitUntilFrameworkReady();
 
   const capabilities = startServices[0].application.capabilities;
   const hasBeatsCapability = capabilities.management.ingest?.[MANAGEMENT_SECTION] ?? false;
diff --git a/x-pack/plugins/cross_cluster_replication/public/plugin.ts b/x-pack/plugins/cross_cluster_replication/public/plugin.ts
index 24c9d8dae379d1..7998cdbdf750b9 100644
--- a/x-pack/plugins/cross_cluster_replication/public/plugin.ts
+++ b/x-pack/plugins/cross_cluster_replication/public/plugin.ts
@@ -73,18 +73,21 @@ export class CrossClusterReplicationPlugin implements Plugin {
 
     // NOTE: We enable the plugin by default instead of disabling it by default because this
     // creates a race condition that causes functional tests to fail on CI (see #66781).
-    licensing.license$
-      .pipe(first())
-      .toPromise()
-      .then((license) => {
+    Promise.all([licensing.license$.pipe(first()).toPromise(), getStartServices()]).then(
+      ([license, startServices]) => {
         const licenseStatus = license.check(PLUGIN.ID, PLUGIN.minimumLicenseType);
         const isLicenseOk = licenseStatus.state === 'valid';
         const config = this.initializerContext.config.get<ClientConfigType>();
 
+        const capabilities = startServices[0].application.capabilities;
+
         // remoteClusters.isUiEnabled is driven by the xpack.remote_clusters.ui.enabled setting.
         // The CCR UI depends upon the Remote Clusters UI (e.g. by cross-linking to it), so if
         // the Remote Clusters UI is disabled we can't show the CCR UI.
-        const isCcrUiEnabled = config.ui.enabled && remoteClusters.isUiEnabled;
+        const isCcrUiEnabled =
+          capabilities.management.data?.[MANAGEMENT_ID] &&
+          config.ui.enabled &&
+          remoteClusters.isUiEnabled;
 
         if (isLicenseOk && isCcrUiEnabled) {
           if (indexManagement) {
@@ -106,7 +109,8 @@ export class CrossClusterReplicationPlugin implements Plugin {
         } else {
           ccrApp.disable();
         }
-      });
+      }
+    );
   }
 
   public start() {}
diff --git a/x-pack/plugins/watcher/public/plugin.ts b/x-pack/plugins/watcher/public/plugin.ts
index 9cc0b1bbe99a80..6c6d6f1169658e 100644
--- a/x-pack/plugins/watcher/public/plugin.ts
+++ b/x-pack/plugins/watcher/public/plugin.ts
@@ -6,9 +6,10 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, Plugin, CoreStart } from 'kibana/public';
+import { CoreSetup, Plugin, CoreStart, Capabilities } from 'kibana/public';
 import { first, map, skip } from 'rxjs/operators';
 
+import { Subject, combineLatest } from 'rxjs';
 import { FeatureCatalogueCategory } from '../../../../src/plugins/home/public';
 
 import { LicenseStatus } from '../common/types/license_status';
@@ -26,6 +27,8 @@ const licenseToLicenseStatus = (license: ILicense): LicenseStatus => {
 };
 
 export class WatcherUIPlugin implements Plugin<void, void, Dependencies, any> {
+  private capabilities$: Subject<Capabilities> = new Subject();
+
   setup(
     { notifications, http, uiSettings, getStartServices }: CoreSetup,
     { licensing, management, data, home, charts }: Dependencies
@@ -99,13 +102,16 @@ export class WatcherUIPlugin implements Plugin<void, void, Dependencies, any> {
 
     home.featureCatalogue.register(watcherHome);
 
-    licensing.license$.pipe(first(), map(licenseToLicenseStatus)).subscribe(({ valid }) => {
+    combineLatest([
+      licensing.license$.pipe(first(), map(licenseToLicenseStatus)),
+      this.capabilities$,
+    ]).subscribe(([{ valid }, capabilities]) => {
       // NOTE: We enable the plugin by default instead of disabling it by default because this
       // creates a race condition that can cause the app nav item to not render in the side nav.
       // The race condition still exists, but it will result in the item rendering when it shouldn't
       // (e.g. on a license it's not available for), instead of *not* rendering when it *should*,
       // which is a less frustrating UX.
-      if (valid) {
+      if (valid && capabilities.management.insightsAndAlerting?.watcher === true) {
         watcherESApp.enable();
       } else {
         watcherESApp.disable();
@@ -113,7 +119,9 @@ export class WatcherUIPlugin implements Plugin<void, void, Dependencies, any> {
     });
   }
 
-  start(core: CoreStart) {}
+  start(core: CoreStart) {
+    this.capabilities$.next(core.application.capabilities);
+  }
 
   stop() {}
 }