SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsdefender-for-cloud-apps

defender-for-cloud-apps

Security & auditing

View repository

Updated 10-16 01:14

About this skill

Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS security solution providing visibility into cloud app usage, governance of OAuth-connected apps, real-time session controls via Conditional Access App Control, and threat detection across connected SaaS services.

When to use

Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session controls, and managing SaaS posture (SSPM). Use this skill when the question is about applications (SaaS or third-party), not IaaS or endpoints.

Do not use this skill for IaaS / PaaS posture (defender-for-cloud-hardening), EDR (defender-for-endpoint), or DLP authoring (purview-dlp-policy).

Pick the MDA capability

Goal Capability Notes
Find unsanctioned cloud apps in use Cloud Discovery via MDE integration Agentless; uses MDE telemetry
Get activity / file visibility for sanctioned SaaS App connector (API-based) M365, Salesforce, ServiceNow, Workday
Govern OAuth apps connected to Microsoft 365 App governance add-on Risk score + automated policies
Block file download in browser session Conditional Access App Control (session) Reverse proxy; integrates with CA
Detect anomalous user activity (impossible travel, mass download) Anomaly detection policies UEBA-style
Posture for connected SaaS (config drift) SaaS Security Posture Management (SSPM) Per-app recommendations
Investigate / contain a compromised SaaS account Governance actions Suspend, force re-auth, revoke OAuth

Rule of thumb: start with Cloud Discovery via MDE (free with E5) to find shadow IT and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it narrowly.

Approach

  1. Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on. No agents, no log uploads - discovery happens automatically from MDE telemetry on managed endpoints. Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.

  2. Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved apps; unsanction risky / unused apps (MDE then blocks them on managed endpoints). Verify: top 10 high-user-count high-risk apps reviewed weekly.

  3. Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow, Workday, GitHub Enterprise via API connector. Provides activity log, file inventory, admin / user account governance.

  4. Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS blast radius. App governance scores third-party OAuth apps by risk and permission privilege. Auto-policy: block apps requesting > X high-privilege permissions or unverified publisher. Verify: app governance shows risk distribution; high-risk apps either approved or blocked, not lingering.

  5. Conditional Access App Control - pilot session policies — Reverse-proxy session control for browser sessions to cloud apps. Use cases: block download on unmanaged devices, force document-labeling on upload, monitor copy/paste. Verify: a session from an unmanaged device shows the watermark / download block; from a compliant device, no friction.

  6. Anomaly detection + alert tuning — Default policies (impossible travel, mass download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to Defender XDR for unified incident view.

  7. Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the top 5 alert types (impossible travel, mass download, OAuth consent granted, file externally shared, admin activity from unusual location).

Guardrails

  • Cloud Discovery data can include user activity - set anonymisation per privacy requirements. EU works councils may require user anonymisation in the discovery view.
  • Pilot session policies; reverse-proxy session control can affect app behaviour. Some SaaS app features break under the reverse proxy. Test thoroughly per app.
  • Prioritise app governance for apps with broad Microsoft Graph permissions. Mail.Read
    • Files.Read.All for a third-party app = data-exfil risk on first compromise. Review before consent or auto-block.
  • Sanction state matters. Unsanctioning blocks via MDE - confirm impact before flipping high-user apps.
  • OAuth consent should be admin-only for most permissions. User-consent for high- privilege scopes is a phish-then-consent route.
  • MDA isn't DLP. Use Purview DLP for content-aware policies; MDA for context (session, app, device).

Common anti-patterns

  • "Discover apps but never sanction" - Visibility without action. Sort by risk, decide.
  • "Auto-block all newly discovered apps" - User outrage; legitimate apps blocked. Review then sanction / unsanction.
  • "OAuth governance later - it's just app permissions" - First compromised OAuth app with Mail.Read = mass exfil. Govern from day one.
  • "Session policies on every app" - Pilot one app; broaden carefully.
  • "Ignore the privacy / works-council angle" - Discovery rollout blocked by HR or legal mid-flight. Anonymisation question is the first one.
  • "MDA alerts not in XDR / Sentinel" - Analysts miss them. Stream by default.

Example prompts

  • Discover shadow IT via Defender for Endpoint integration and sanction or unsanction cloud apps.
  • Set up Conditional Access App Control session policies for unmanaged devices.
  • Assess OAuth app risk with app governance and block high-risk consents.
  • Connect Microsoft 365 and Salesforce via app connectors for full activity visibility.
  • Tune impossible-travel and mass-download anomaly policies.
  • Stream MDA alerts into Defender XDR for unified investigation.

Microsoft Learn