Defender for Cloud Apps: Discover & Control

What is Microsoft Defender for Cloud Apps?

Cloud Discovery — finding shadow IT

Cloud Discovery analyses network traffic logs to identify every cloud app your organisation uses — not just the ones IT knows about.

How Cloud Discovery works

Discovery Method	How It Works	Best For
Log collector	Upload firewall/proxy logs (Palo Alto, Zscaler, Squid, etc.) manually or automatically	Organisations with on-premises network infrastructure
Defender for Endpoint integration	Agents on devices report cloud app traffic directly	Modern endpoint-managed environments (no proxy needed)
Secure Web Gateway	Zscaler or other SWG forwards logs directly	Organisations using cloud-based web gateways

The Cloud Discovery dashboard

After data flows in, the dashboard shows:

• Total apps discovered — typically hundreds or thousands (most organisations are shocked)
• Risk score per app — 1 (highest risk) to 10 (lowest risk) based on 90+ risk factors
• Categories — collaboration, storage, CRM, development, etc.
• Users and traffic — who’s using which app, how much data is flowing
• Sanctioned vs unsanctioned — apps you’ve approved vs apps you haven’t

Sanctioned and unsanctioned apps

Status	Meaning	Action
Sanctioned	Approved by IT — safe to use	App is tagged as approved. Used as a signal in policies.
Unsanctioned	Not approved — blocked or flagged	Can generate block scripts for firewalls/proxies. Users see a warning page.
Monitored	Under review — neither approved nor blocked	IT is evaluating the app before making a decision.

ℹ️ Scenario: Anika discovers shadow IT

🛡️ Anika Weber at Sentinel Partners runs a Cloud Discovery analysis for a new banking client. She integrates Defender for Endpoint (already deployed on all devices) with Defender for Cloud Apps.

Discoveries after 7 days:

• 847 cloud apps detected (the client expected about 30)
• 3 file-sharing apps with risk score 2 (no encryption, servers in non-compliant jurisdictions) being used by the finance team
• 12 AI tools (ChatGPT, Midjourney, etc.) with data being uploaded by developers
• 1 CRM app scoring 8/10 but not on the approved vendor list

Anika’s actions:

1. Unsanctions the 3 risky file-sharing apps → generates firewall block scripts
2. Tags the AI tools as monitored → starts a policy review with the CISO
3. Sanctions the CRM app after verifying it meets compliance requirements
4. Presents a risk report to the client’s board showing data exposure through unapproved apps

Result: The client goes from blind to fully informed in one week. Shadow IT is no longer invisible.

Connected apps — deep visibility

Connected apps give Defender for Cloud Apps API-level access to sanctioned cloud services, enabling:

• User activity monitoring (who accessed what, when)
• File scanning (DLP — detect sensitive data in cloud storage)
• Anomaly detection (impossible travel, mass downloads)
• Governance actions (quarantine files, suspend accounts)

App connectors

Connector	What It Monitors
Microsoft 365	Exchange, SharePoint, OneDrive, Teams activity
Azure	Azure resource management, sign-in activity
Salesforce	User activity, file sharing, admin changes
Google Workspace	Drive, Gmail, Admin console activity
Dropbox	File sharing, user activity
Box, ServiceNow, Okta, GitHub, etc.	Service-specific activities

Connecting an app:

1. Defender for Cloud Apps portal → Settings → Connected apps → App connectors
2. Click Connect an app → select the app
3. Follow the wizard (typically involves authorising the connector with an admin account in the target app)
4. Once connected, data starts flowing within minutes to hours

💡 Exam tip: Connector permissions

Connecting an app requires admin credentials in the target app (e.g., a Salesforce admin account). The connector uses the target app’s API to pull activity logs and file metadata. For Microsoft 365, the connection is automatic when Defender for Cloud Apps is part of your Microsoft 365 E5 or EMS E5 licence.

Application-enforced restrictions

Application-enforced restrictions use Entra ID Conditional Access to signal to apps (primarily SharePoint Online and Exchange Online) that a session is restricted. The app itself enforces the restriction.

How it works:

1. A Conditional Access policy targets SharePoint Online or Exchange Online
2. The policy grants access with the session control: “Use app enforced restrictions”
3. When a user signs in from a non-compliant device, Entra ID sends a claim to the app
4. SharePoint/Exchange reads the claim and limits functionality (e.g., read-only, no downloads)

Example restrictions in SharePoint Online:

• Full access: compliant device → normal experience
• Limited web-only access: unmanaged device → can view but not download, sync, or print
• Block access: blocked by policy → access denied

💡 Exam tip: App-enforced vs CA App Control

Don’t confuse these two:

• Application-enforced restrictions: The app (SharePoint/Exchange) enforces limits. Works only for these Microsoft apps. Simple to configure. Limited to the restrictions the app supports.
• Conditional Access App Control: Defender for Cloud Apps acts as a reverse proxy. Works for any supported app. More granular — can block copy/paste, watermark downloads, block specific file types.

Conditional Access App Control — real-time session governance

Conditional Access App Control routes user sessions through a reverse proxy (Defender for Cloud Apps), enabling real-time monitoring and control.

Architecture

User signs in via Entra ID
    ↓ Conditional Access policy applies "Use Conditional Access App Control"
Session is routed through Defender for Cloud Apps reverse proxy
    ↓ URL changes to *.mcas.ms (e.g., app.contoso.com → app.contoso.com.mcas.ms)
Defender for Cloud Apps inspects every action in real time
    ↓ Applies access and session policies
Traffic is forwarded to the actual app

Setting it up

1. Create a Conditional Access policy in Entra ID:

   • Target the app(s) you want to protect
   • Under Session controls → select “Use Conditional Access App Control”
   • Choose “Monitor only” (for testing) or “Use custom policy” (for enforcement)

2. Sign in to the app as a user covered by the policy — this onboards the app to Defender for Cloud Apps automatically (for gallery apps)

3. Create access or session policies in Defender for Cloud Apps (covered in the next module)

Supported apps

App Type	Onboarding
Featured Microsoft apps (SharePoint, Exchange, Teams, etc.)	Automatic — just create the CA policy
Featured third-party apps (Salesforce, Box, Dropbox, etc.)	Automatic — sign in after CA policy creation
Custom/non-gallery apps	Manual onboarding — add the app in Defender for Cloud Apps settings

ℹ️ Scenario: Priya implements CA App Control for SharePoint

🔐 Priya Sharma at Meridian Health wants to prevent clinicians from downloading patient files when using personal devices:

1. Conditional Access policy:

   • Users: All clinical staff
   • Cloud apps: SharePoint Online
   • Conditions: Device state = unmanaged (not compliant, not hybrid joined)
   • Session: Use Conditional Access App Control → Use custom policy

2. Session policy in Defender for Cloud Apps:

   • Activity type: Download file
   • Filter: Files labelled “Confidential” or “Patient Data”
   • Action: Block

Result: Clinicians on personal devices can view patient files in the browser but cannot download them. On managed hospital devices, downloads work normally. Every blocked attempt is logged for audit.

🎬 Video walkthrough

🎬 Video coming soon

Defender for Cloud Apps Discovery & Control — SC-300 Module 20

Defender for Cloud Apps Discovery & Control — SC-300 Module 20

~12 min

Flashcards

Question

What is Cloud Discovery in Defender for Cloud Apps?

Click or press Enter to reveal answer

Answer

Cloud Discovery analyses network traffic (from firewall logs, Defender for Endpoint, or secure web gateways) to identify all cloud apps being used in the organisation — including shadow IT. It assigns risk scores and lets admins sanction or unsanction apps.

Click to flip back

Question

What is the difference between app-enforced restrictions and Conditional Access App Control?

Click or press Enter to reveal answer

Answer

App-enforced restrictions: the app itself (SharePoint/Exchange) enforces limits based on a Conditional Access signal. Only works for select Microsoft apps. CA App Control: Defender for Cloud Apps acts as a reverse proxy, inspecting every action in real time. Works for many apps with more granular controls (block downloads, watermark, block paste).

Click to flip back

Question

What is a connected app in Defender for Cloud Apps?

Click or press Enter to reveal answer

Answer

A cloud app connected via API to Defender for Cloud Apps, providing deep visibility into user activity, file content, anomaly detection, and governance actions. Connectors exist for Microsoft 365, Azure, Salesforce, Google Workspace, Dropbox, Box, and more.

Click to flip back

Question

How does Conditional Access App Control route traffic?

Click or press Enter to reveal answer

Answer

After a Conditional Access policy triggers CA App Control, the user's session is redirected through the Defender for Cloud Apps reverse proxy. URLs change to the *.mcas.ms domain. The proxy inspects every request in real time and applies access/session policies before forwarding traffic to the actual app.

Click to flip back

Knowledge Check

Knowledge Check

Anika's client wants to identify all cloud apps being used across the organisation without installing any new infrastructure. The client already has Defender for Endpoint on all devices. What should Anika configure?

AEnable the Defender for Endpoint integration in Defender for Cloud Apps for automatic Cloud DiscoveryBSet up a log collector on a dedicated server to receive firewall logsCAsk all employees to self-report which cloud apps they use via a surveyDCheck the Entra ID sign-in logs for OAuth consent events

Check Answer

Knowledge Check

Priya wants clinicians on unmanaged devices to view SharePoint files but not download them. She doesn't need advanced controls — just block downloads. What's the simplest approach?

ACreate a Conditional Access policy with app-enforced restrictions for SharePoint Online, then configure SharePoint's limited access policyBDeploy Defender for Cloud Apps CA App Control with a custom session policy blocking all file typesCBlock unmanaged devices entirely from accessing SharePoint Online via Conditional AccessDUse Microsoft Purview DLP policies to prevent file downloads from SharePoint

Check Answer

Knowledge Check

After enabling Conditional Access App Control for Salesforce, Anika notices the URL changes to salesforce.com.mcas.ms when users access the app. A user reports that a custom Salesforce plugin no longer works. What is the most likely cause?

AThe Salesforce licence has expiredBDefender for Cloud Apps has automatically blocked the plugin as malwareCThe Conditional Access policy has a misconfigured grant controlDThe custom plugin uses hardcoded URLs that don't match the *.mcas.ms reverse proxy domain

Check Answer

---

Next up: Defender for Cloud Apps: Policies & OAuth Governance — how to create access and session policies, manage OAuth app risks, and use the cloud app catalog for governance.