# Defender For Cloud Apps

> Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection. Covers Cloud Discovery via Defender for Endpoint integration, OAuth app governance, Conditional Access App Control (reverse-proxy session policies), and SaaS security posture (SSPM). WHEN: Defender for Cloud Apps, MDA, CASB, shadow IT discovery, cloud app governance, OAuth app risk, session control, Conditional Access App Control, SaaS security posture management, SSPM, sanction or unsanction app, Cloud App Catalog, app connectors. DO NOT USE for IaaS / PaaS posture (use defender-for-cloud-hardening), endpoint EDR (use defender-for-endpoint), or DLP (use purview-dlp-policy).

- Skill: `vinayaklatthe/defender-for-cloud-apps` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vinayaklatthe/defender-for-cloud-apps`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vinayaklatthe/defender-for-cloud-apps/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: vinayaklatthe (https://skillmd.com/u/vinayaklatthe)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/vinayaklatthe/defender-for-cloud-apps

---


# Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS
security solution providing visibility into cloud app usage, governance of OAuth-connected
apps, real-time session controls via Conditional Access App Control, and threat detection
across connected SaaS services.

## When to use
Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session
controls, and managing SaaS posture (SSPM). Use this skill when the question is about
**applications** (SaaS or third-party), not IaaS or endpoints.

**Do not use this skill** for IaaS / PaaS posture (`defender-for-cloud-hardening`), EDR
(`defender-for-endpoint`), or DLP authoring (`purview-dlp-policy`).

## Pick the MDA capability

| Goal | Capability | Notes |
|---|---|---|
| Find unsanctioned cloud apps in use | **Cloud Discovery** via MDE integration | Agentless; uses MDE telemetry |
| Get activity / file visibility for sanctioned SaaS | **App connector** (API-based) | M365, Salesforce, ServiceNow, Workday |
| Govern OAuth apps connected to Microsoft 365 | **App governance** add-on | Risk score + automated policies |
| Block file download in browser session | **Conditional Access App Control** (session) | Reverse proxy; integrates with CA |
| Detect anomalous user activity (impossible travel, mass download) | **Anomaly detection policies** | UEBA-style |
| Posture for connected SaaS (config drift) | **SaaS Security Posture Management (SSPM)** | Per-app recommendations |
| Investigate / contain a compromised SaaS account | **Governance actions** | Suspend, force re-auth, revoke OAuth |

> **Rule of thumb:** start with Cloud Discovery via MDE (free with E5) to find shadow IT
> and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session
> control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it
> narrowly.

## Approach

1. **Enable Cloud Discovery via MDE** — Integration → Microsoft Defender for Endpoint → on.
   No agents, no log uploads - discovery happens automatically from MDE telemetry on
   managed endpoints.
   *Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.*

2. **Triage the Cloud App Catalog** — Sort by risk score + user count. **Sanction** approved
   apps; **unsanction** risky / unused apps (MDE then blocks them on managed endpoints).
   *Verify: top 10 high-user-count high-risk apps reviewed weekly.*

3. **Connect sanctioned SaaS via app connectors** — Microsoft 365, Salesforce, ServiceNow,
   Workday, GitHub Enterprise via API connector. Provides activity log, file inventory,
   admin / user account governance.

4. **Turn on app governance for OAuth risk** — Microsoft Graph permissions are the SaaS
   blast radius. App governance scores third-party OAuth apps by risk and permission
   privilege. Auto-policy: block apps requesting > X high-privilege permissions or
   unverified publisher.
   *Verify: app governance shows risk distribution; high-risk apps either approved or
   blocked, not lingering.*

5. **Conditional Access App Control - pilot session policies** — Reverse-proxy session
   control for browser sessions to cloud apps. Use cases: block download on unmanaged
   devices, force document-labeling on upload, monitor copy/paste.
   *Verify: a session from an unmanaged device shows the watermark / download block; from
   a compliant device, no friction.*

6. **Anomaly detection + alert tuning** — Default policies (impossible travel, mass
   download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to
   Defender XDR for unified incident view.

7. **Operationalise** — Stream MDA alerts into XDR / Sentinel. Define playbooks for the
   top 5 alert types (impossible travel, mass download, OAuth consent granted, file
   externally shared, admin activity from unusual location).

## Guardrails
- **Cloud Discovery data can include user activity - set anonymisation per privacy
  requirements.** EU works councils may require user anonymisation in the discovery view.
- **Pilot session policies; reverse-proxy session control can affect app behaviour.** Some
  SaaS app features break under the reverse proxy. Test thoroughly per app.
- **Prioritise app governance for apps with broad Microsoft Graph permissions.** Mail.Read
  + Files.Read.All for a third-party app = data-exfil risk on first compromise. Review
  before consent or auto-block.
- **Sanction state matters.** Unsanctioning blocks via MDE - confirm impact before flipping
  high-user apps.
- **OAuth consent should be admin-only for most permissions.** User-consent for high-
  privilege scopes is a phish-then-consent route.
- **MDA isn't DLP.** Use Purview DLP for content-aware policies; MDA for context (session,
  app, device).

## Common anti-patterns
- **"Discover apps but never sanction"** - Visibility without action. Sort by risk, decide.
- **"Auto-block all newly discovered apps"** - User outrage; legitimate apps blocked.
  Review then sanction / unsanction.
- **"OAuth governance later - it's just app permissions"** - First compromised OAuth app
  with Mail.Read = mass exfil. Govern from day one.
- **"Session policies on every app"** - Pilot one app; broaden carefully.
- **"Ignore the privacy / works-council angle"** - Discovery rollout blocked by HR or
  legal mid-flight. Anonymisation question is the first one.
- **"MDA alerts not in XDR / Sentinel"** - Analysts miss them. Stream by default.

## Example prompts
- `Discover shadow IT via Defender for Endpoint integration and sanction or unsanction cloud apps.`
- `Set up Conditional Access App Control session policies for unmanaged devices.`
- `Assess OAuth app risk with app governance and block high-risk consents.`
- `Connect Microsoft 365 and Salesforce via app connectors for full activity visibility.`
- `Tune impossible-travel and mass-download anomaly policies.`
- `Stream MDA alerts into Defender XDR for unified investigation.`

## Microsoft Learn
- MDA overview: https://learn.microsoft.com/defender-cloud-apps/what-is-defender-for-cloud-apps
- Cloud Discovery: https://learn.microsoft.com/defender-cloud-apps/set-up-cloud-discovery
- MDE integration for Discovery: https://learn.microsoft.com/defender-cloud-apps/mde-integration
- App governance: https://learn.microsoft.com/defender-cloud-apps/app-governance-manage-app-governance
- Conditional Access App Control: https://learn.microsoft.com/defender-cloud-apps/proxy-intro-aad
- App connectors: https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
- Anomaly detection: https://learn.microsoft.com/defender-cloud-apps/anomaly-detection-policy
- SSPM: https://learn.microsoft.com/defender-cloud-apps/security-saas