Cloud App Security: Investigate Shadow IT
Users connect to hundreds of cloud apps your IT team never approved. Learn how Defender for Cloud Apps discovers shadow IT, investigates risky OAuth apps, and detects suspicious cloud activities.
What is shadow IT?
Shadow IT is the app your marketing team signed up for without telling IT.
The design team uses Canva. Sales uses a third-party CRM. Someone gave a random AI tool access to their Microsoft 365 account. None of these were approved, reviewed, or secured by IT.
Defender for Cloud Apps (MDCA) discovers these shadow apps, assesses their risk, and lets you investigate suspicious activity. It also monitors approved cloud apps (like Salesforce, Box, Dropbox) for unusual behaviour — mass downloads, impossible travel, or privilege escalation.
As a SOC analyst, you investigate MDCA alerts when users do risky things with cloud apps — especially OAuth app consents that grant third-party apps access to your organisation’s data.
Cloud app discovery
MDCA discovers cloud apps your organisation uses by analysing:
- Firewall and proxy logs — which cloud services are employees connecting to
- Defender for Endpoint signals — app usage data from managed devices
- Entra ID app registrations — which third-party apps have been granted access
The Cloud App Catalog
MDCA rates over 31,000 cloud apps on a risk score (1-10) based on:
- Security certifications (SOC 2, ISO 27001, GDPR compliance)
- Encryption (at rest, in transit)
- Data ownership and portability
- Legal and regulatory compliance
- Known vulnerabilities and breaches
Apps scoring below your threshold can be sanctioned (approved), unsanctioned (blocked), or monitored.
OAuth app investigation
OAuth apps are the biggest shadow IT risk. When a user clicks “Allow” on a third-party app, they grant that app permissions to read their email, files, or calendar — sometimes with full access.
Risky OAuth scenarios
| Scenario | Risk | MDCA Detection |
|---|---|---|
| Overprivileged app | App requests Mail.ReadWrite but only needs Calendar.Read | App governance alert |
| Suspicious consent | User grants full mailbox access to an unknown app | OAuth app anomaly |
| App impersonation | Malicious app name mimics a trusted brand | App governance alert |
| Mass data access | App reads thousands of emails after consent | Activity alert |
| App from untrusted publisher | App published by an unverified developer | Risk score alert |
Investigation workflow for OAuth alerts
- Review the app — what permissions did it request? Who published it? What is its risk score?
- Check consenting users — who granted access? When? From which device?
- Review app activity — what has the app done since consent? (emails read, files accessed, data exported)
- Assess legitimacy — is this a known business tool or a suspicious unknown app?
- Remediate:
- Revoke the app’s permissions in Entra ID
- Ban the app in MDCA to prevent future consents
- Notify the user about safe app consent practices
- Review all consents from the same user (if their account is compromised, the attacker may have consented to multiple apps)
Scenario: Elena investigates a suspicious OAuth app
Elena at Atlas Bank gets an MDCA alert: “High-risk OAuth app — ‘DocuSign-Verify’ granted full mailbox access.”
Investigation:
- The app name mimics DocuSign but is published by an unknown developer
- 3 users consented — all in the finance department
- The app has read 1,200 emails from each user in the past 24 hours
- Several emails contain wire transfer instructions and account numbers
This is a consent phishing attack.
Remediation:
- Revoke the app’s permissions immediately
- Ban the app in MDCA
- Reset passwords and revoke sessions for the 3 users
- Check if any wire transfer instructions were forwarded externally
- Alert the fraud team about potential BEC follow-up
Suspicious cloud activities
Beyond OAuth, MDCA detects anomalous behaviour in connected cloud apps:
| Activity | What MDCA Detects |
|---|---|
| Mass download | User downloads unusually large number of files from SharePoint/OneDrive |
| Impossible travel | User accesses Salesforce from two countries within impossible timeframe |
| Privilege escalation | User’s role is elevated in a connected SaaS app |
| Risky sign-in | Sign-in to cloud app from anonymous IP or Tor |
| Data sharing | Files shared externally from a connected app (Box, Dropbox) |
Exam tip: MDCA vs Entra ID Protection
Both detect impossible travel, but for different scopes:
- Entra ID Protection detects impossible travel for Entra ID sign-ins (Microsoft 365, Azure portal)
- MDCA detects impossible travel for connected SaaS apps (Salesforce, Box, Dropbox, ServiceNow)
If the question specifies “sign-in to a third-party SaaS app,” the answer is MDCA, not Entra ID.
Elena discovers that a malicious OAuth app named 'DocuSign-Verify' has read 1,200 emails from 3 finance users at Atlas Bank. What should she do first?
An MDCA alert shows impossible travel for a Salesforce user — signed in from London at 10 AM and from Tokyo at 10:30 AM. Which product detected this?
🎬 Video coming soon
Next up: Cloud app threats are handled. Now let’s investigate incidents in Microsoft Sentinel — the central SIEM where all these signals come together.