Defender For Cloud Apps

Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS security solution providing visibility into cloud app usage, governance of OAuth-connected apps, real-time session controls via Conditional Access App Control, and threat detection across connected SaaS services.

When to use

Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session controls, and managing SaaS posture (SSPM). Use this skill when the question is about applications (SaaS or third-party), not IaaS or endpoints.

Do not use this skill for IaaS / PaaS posture (defender-for-cloud-hardening), EDR (defender-for-endpoint), or DLP authoring (purview-dlp-policy).

Pick the MDA capability

Rule of thumb: start with Cloud Discovery via MDE (free with E5) to find shadow IT and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it narrowly.

Approach

1. Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on. No agents, no log uploads - discovery happens automatically from MDE telemetry on managed endpoints. Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.

2. Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved apps; unsanction risky / unused apps (MDE then blocks them on managed endpoints). Verify: top 10 high-user-count high-risk apps reviewed weekly.

3. Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow, Workday, GitHub Enterprise via API connector. Provides activity log, file inventory, admin / user account governance.

4. Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS blast radius. App governance scores third-party OAuth apps by risk and permission privilege. Auto-policy: block apps requesting > X high-privilege permissions or unverified publisher. Verify: app governance shows risk distribution; high-risk apps either approved or blocked, not lingering.

5. Conditional Access App Control - pilot session policies — Reverse-proxy session control for browser sessions to cloud apps. Use cases: block download on unmanaged devices, force document-labeling on upload, monitor copy/paste. Verify: a session from an unmanaged device shows the watermark / download block; from a compliant device, no friction.

6. Anomaly detection + alert tuning — Default policies (impossible travel, mass download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to Defender XDR for unified incident view.

7. Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the top 5 alert types (impossible travel, mass download, OAuth consent granted, file externally shared, admin activity from unusual location).

Guardrails

• Cloud Discovery data can include user activity - set anonymisation per privacy requirements. EU works councils may require user anonymisation in the discovery view.
• Pilot session policies; reverse-proxy session control can affect app behaviour. Some SaaS app features break under the reverse proxy. Test thoroughly per app.
• Prioritise app governance for apps with broad Microsoft Graph permissions. Mail.Read
  • Files.Read.All for a third-party app = data-exfil risk on first compromise. Review before consent or auto-block.
• Sanction state matters. Unsanctioning blocks via MDE - confirm impact before flipping high-user apps.
• OAuth consent should be admin-only for most permissions. User-consent for high- privilege scopes is a phish-then-consent route.
• MDA isn't DLP. Use Purview DLP for content-aware policies; MDA for context (session, app, device).

Common anti-patterns

• "Discover apps but never sanction" - Visibility without action. Sort by risk, decide.
• "Auto-block all newly discovered apps" - User outrage; legitimate apps blocked. Review then sanction / unsanction.
• "OAuth governance later - it's just app permissions" - First compromised OAuth app with Mail.Read = mass exfil. Govern from day one.
• "Session policies on every app" - Pilot one app; broaden carefully.
• "Ignore the privacy / works-council angle" - Discovery rollout blocked by HR or legal mid-flight. Anonymisation question is the first one.
• "MDA alerts not in XDR / Sentinel" - Analysts miss them. Stream by default.

Example prompts

• Discover shadow IT via Defender for Endpoint integration and sanction or unsanction cloud apps.
• Set up Conditional Access App Control session policies for unmanaged devices.
• Assess OAuth app risk with app governance and block high-risk consents.
• Connect Microsoft 365 and Salesforce via app connectors for full activity visibility.
• Tune impossible-travel and mass-download anomaly policies.
• Stream MDA alerts into Defender XDR for unified investigation.

Microsoft Learn

• MDA overview: https://learn.microsoft.com/defender-cloud-apps/what-is-defender-for-cloud-apps
• Cloud Discovery: https://learn.microsoft.com/defender-cloud-apps/set-up-cloud-discovery
• MDE integration for Discovery: https://learn.microsoft.com/defender-cloud-apps/mde-integration
• App governance: https://learn.microsoft.com/defender-cloud-apps/app-governance-manage-app-governance
• Conditional Access App Control: https://learn.microsoft.com/defender-cloud-apps/proxy-intro-aad
• App connectors: https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
• Anomaly detection: https://learn.microsoft.com/defender-cloud-apps/anomaly-detection-policy
• SSPM: https://learn.microsoft.com/defender-cloud-apps/security-saas