Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS security solution providing visibility into cloud app usage, governance of OAuth-connected apps, real-time session controls via Conditional Access App Control, and threat detection across connected SaaS services.

When to use

Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session controls, and managing SaaS posture (SSPM). Use this skill when the question is about applications (SaaS or third-party), not IaaS or endpoints.

Do not use this skill for IaaS / PaaS posture (defender-for-cloud-hardening), EDR (defender-for-endpoint), or DLP authoring (purview-dlp-policy).

Pick the MDA capability

Rule of thumb: start with Cloud Discovery via MDE (free with E5) to find shadow IT
and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session
control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it
narrowly.

Approach

1. Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on.

No agents, no log uploads - discovery happens automatically from MDE telemetry on managed endpoints. Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.

1. Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved

apps; unsanction risky / unused apps (MDE then blocks them on managed endpoints). Verify: top 10 high-user-count high-risk apps reviewed weekly.

1. Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow,

Workday, GitHub Enterprise via API connector. Provides activity log, file inventory, admin / user account governance.

1. Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS

blast radius. App governance scores third-party OAuth apps by risk and permission privilege. Auto-policy: block apps requesting > X high-privilege permissions or unverified publisher. Verify: app governance shows risk distribution; high-risk apps either approved or blocked, not lingering.

1. Conditional Access App Control - pilot session policies — Reverse-proxy session

control for browser sessions to cloud apps. Use cases: block download on unmanaged devices, force document-labeling on upload, monitor copy/paste. Verify: a session from an unmanaged device shows the watermark / download block; from a compliant device, no friction.

1. Anomaly detection + alert tuning — Default policies (impossible travel, mass

download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to Defender XDR for unified incident view.

1. Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the

top 5 alert types (impossible travel, mass download, OAuth consent granted, file externally shared, admin activity from unusual location).

Guardrails

• **Cloud Discovery data can include user activity - set anonymisation per privacy

requirements.** EU works councils may require user anonymisation in the discovery view.

• Pilot session policies; reverse-proxy session control can affect app behaviour. Some

SaaS app features break under the reverse proxy. Test thoroughly per app.

• Prioritise app governance for apps with broad Microsoft Graph permissions. Mail.Read

+ Files.Read.All for a third-party app = data-exfil risk on first compromise. Review before consent or auto-block.

• Sanction state matters. Unsanctioning blocks via MDE - confirm impact before flipping

high-user apps.

• OAuth consent should be admin-only for most permissions. User-consent for high-

privilege scopes is a phish-then-consent route.

• MDA isn't DLP. Use Purview DLP for content-aware policies; MDA for context (session,

app, device).

Common anti-patterns

• "Discover apps but never sanction" - Visibility without action. Sort by risk, decide.
• "Auto-block all newly discovered apps" - User outrage; legitimate apps blocked.

Review then sanction / unsanction.

• "OAuth governance later - it's just app permissions" - First compromised OAuth app

with Mail.Read = mass exfil. Govern from day one.

• "Session policies on every app" - Pilot one app; broaden carefully.
• "Ignore the privacy / works-council angle" - Discovery rollout blocked by HR or

legal mid-flight. Anonymisation question is the first one.

• "MDA alerts not in XDR / Sentinel" - Analysts miss them. Stream by default.

Example prompts

• Discover shadow IT via Defender for Endpoint integration and sanction or unsanction cloud apps.
• Set up Conditional Access App Control session policies for unmanaged devices.
• Assess OAuth app risk with app governance and block high-risk consents.
• Connect Microsoft 365 and Salesforce via app connectors for full activity visibility.
• Tune impossible-travel and mass-download anomaly policies.
• Stream MDA alerts into Defender XDR for unified investigation.

Microsoft Learn

• MDA overview: https://learn.microsoft.com/defender-cloud-apps/what-is-defender-for-cloud-apps
• Cloud Discovery: https://learn.microsoft.com/defender-cloud-apps/set-up-cloud-discovery
• MDE integration for Discovery: https://learn.microsoft.com/defender-cloud-apps/mde-integration
• App governance: https://learn.microsoft.com/defender-cloud-apps/app-governance-manage-app-governance
• Conditional Access App Control: https://learn.microsoft.com/defender-cloud-apps/proxy-intro-aad
• App connectors: https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
• Anomaly detection: https://learn.microsoft.com/defender-cloud-apps/anomaly-detection-policy
• SSPM: https://learn.microsoft.com/defender-cloud-apps/security-saas