Defender for Cloud Apps and App Governance

What it is

Microsoft Defender for Cloud Apps is a cloud access security broker, or CASB. It gives visibility into the cloud apps people use, including unapproved ones, and lets you control access and protect data. For identity administrators it adds controls that Entra alone cannot provide, such as monitoring a session in real time or reviewing the apps that users have granted access to their data.

How it works

Cloud discovery and the cloud app catalog

Cloud discovery shows which cloud apps your users reach, how much data they send and how risky each app is.

• It uses traffic logs from firewalls and proxies uploaded manually or automatically, or from Microsoft Defender for Endpoint integration, which sees traffic from managed devices.
• The cloud app catalog is a large database of apps, each with a risk score from 0 to 10 based on many security and compliance factors.
• Apps can be marked sanctioned, which means approved for use, or unsanctioned, which means not approved. Unsanctioned apps can be blocked through Microsoft Defender for Endpoint.
• The Discovered apps page lists apps and lets you filter by risk score and category, so you can find riskier apps such as personal file sharing tools.

Connected apps

A connected app is a SaaS app linked through its API connector, for example Microsoft 365, Salesforce or Box. Once connected, Defender for Cloud Apps can read activities and files from the app.

• The Activity log shows what users did in the app.
• The Files page lists files in connected apps and can be filtered by access level, such as files shared publicly or with external collaborators, so they can be reviewed.
• Governance actions, such as quarantining a file or removing a collaborator, are recorded in the governance log.

Policies

Conditional Access App Control

Conditional Access App Control sends a user's browser session through a reverse proxy of Defender for Cloud Apps, so it can monitor and control the session. To use it:

1. In Microsoft Entra Conditional Access, create a policy whose session control is Use Conditional Access App Control, either with a built in monitor and control option or a custom policy.
2. In Defender for Cloud Apps, create access and session policies that define the monitoring or blocking.

For example, you can let users from unmanaged devices open a SaaS app but block downloads of files labelled Confidential.

OAuth apps and app governance

Users can grant third party apps access to their mail or files, and a malicious app with these permissions can be very damaging. Defender for Cloud Apps shows these OAuth apps, their permissions and the users who authorised them, and lets you create policies for OAuth apps, for example to alert on apps with high privileges and few users. App governance is an add on that gives deeper control over OAuth apps and their behaviour. You can revoke a risky app's permissions, ban it, or review it.

Choosing the control

A worked scenario

A company suspects that employees store files in personal sharing services. It integrates Defender for Endpoint with Defender for Cloud Apps, so Cloud discovery lists the apps in use with risk scores. A few risky file sharing apps are marked unsanctioned. For the approved SaaS apps, it connects Microsoft 365 and Salesforce, and an analyst reviews the Files page filtered to publicly shared files. A Conditional Access policy sends sessions from unmanaged devices through Conditional Access App Control, where a session policy blocks downloads. An OAuth app policy alerts on apps that request mail permissions and have only a few users.