Implementing and Managing Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDA) is the cloud access security broker (CASB) in Microsoft 365 Defender. Simply put, it sits between your users and their access to websites, cloud apps, software as a service (SaaS), and infrastructure as a service (IaaS). As apps, services, and infrastructure have moved to the cloud, the level of visibility and control we have over them has, in some cases, been reduced. This is where MDA steps in, enhancing that visibility and giving us the means to also control what previously couldn’t be in our SaaS and IaaS.

In Chapter 2, you learned about the many capabilities MDA has at a high level and, in this chapter, we’ll explore things in more detail. You’ll leave this chapter knowing how to do the following:

• Customize MDA settings for your environment
• Manage shadow IT discovery
• Connect apps for investigation and governance, then implement session policies...

Exploring MDA settings

As with most security services, in MDA, we must tweak several settings to get things tuned to our specific environment. General settings for MDA can be found by going to Microsoft 365 Defender portal | Settings | Cloud apps:

Figure 16.2 – MDA settings in the Microsoft 365 Defender portal

For now, we’re going to look at the settings in the System and Information Protection categories. We’ll look at the other categories throughout this chapter.

Customizing system settings

There are several changes you should make to improve defaults in the Cloud Apps settings page you just navigated to. Let’s check them out!

Starting in Organization details, you can customize the environment to your organization by changing the organization’s display name and environment name, as well as uploading a logo (limited to a rather small 150 x 50 pixels). You’ll also see a list of Managed domains, which MDA...

Discovering and managing shadow IT

Reliable inventory is foundational to cybersecurity. We need to know what devices, identities, and infrastructure we have to adequately secure them and reduce the attack surface. With this in mind, ask yourself: do you know your cloud app inventory? Cloud apps is the umbrella term for web apps and SaaS. While you’re probably aware your business uses services such as Office 365 and some others, you probably won’t know it all, and this problem will grow as your organization grows.

We call this type of unknown, unmanaged IT and cloud app usage shadow IT. It poses a risk because the following generally haven’t occurred:

• Legal assessments, such as data residency and ownership policy
• Security assessments, such as support for single sign-on (SSO) and admin audit trails
• Internal compliance assessments, such as disaster recovery plans

Most shadow IT usage is simply users trying to get their job done as quickly...

Managing cloud apps with policies

Now that you’ve mastered how to discover and govern shadow IT, we’ll dive into managing cloud apps. MDA offers us two ways to do this, as depicted in the following figure:

Figure 16.19 – Difference between MDA app control methods

Connected apps is the first method. This feature is for a list of supported cloud apps and integrates them with MDA directly using APIs. This is the highest level of integration with MDA as its CASB capabilities can directly communicate with and control the cloud app to the furthest extent the provider’s APIs allow. This list, and the extent of your control, are managed by Microsoft. For example, you could connect Dropbox to govern files saved in it. An advantage of this method is that you achieve deep integration with the cloud app.

Conditional Access App Control is the second method. This is a reverse proxy capability that’s integrated with your identity...

Governing OAuth apps

OAuth 2.0 is a standard for delegating access to app resources. Think of it as application X getting permission to certain parts of application Y. We call the app that receives this access an OAuth app. If you’ve ever given an app permission to access or manage your name details, mailbox, and calendar information, you’ve probably used OAuth 2.0 to do so. This is also true for any PowerShell scripts that interact with the Microsoft Graph API.

This is a great advancement from the historical way of giving access, which involved handing over your username and password, giving unrestricted abilities to the app. But it has its challenges. Attackers love persistence, as you learned about when we reviewed MITRE ATT&CK in Chapter 1. OAuth apps do not require login credentials to get access, and unless access is revoked, they will continue to get delegated access. This means two of the main threats you’ll see with OAuth apps are malicious apps...

Summary

Reading through this chapter, you’ll have learned about a lot of security and compliance options for cloud apps. Acting as Microsoft’s CASB, MDA is a service that all customers who are licensed to it are encouraged to make the most of.

To recap, we started this chapter by laying a solid foundation for MDA by covering fundamental settings. We continued by discussing its shadow IT discovery and management capabilities. By taking control of your environment’s shadow IT, you reduce the risk of regulatory failures and cybersecurity threats. Then, we moved on to establishing control of connected cloud apps with policies. This is important because it means you can refine users’ abilities when accessing apps, such as different levels of permission when accessing apps on BYOD devices. Our review of cloud apps then sprawled over to OAuth apps, including add-on licensing options for enhanced capabilities, so that you can make sure permissions are appropriately...

Questions

If you want to test your understanding of what you learned in this chapter, have a go at the following questions about MDA:

1. If you have internal or regulatory compliance reasons to protect the activities of some members of your organization from general administrators, which of the following would be the most appropriate feature to configure?
   1. Create a file policy
   2. Connect Microsoft Priva to MDA
   3. Configure activity privacy
   4. Create an activity policy
2. Which of the following is a benefit of MDA integrating with MDE? Choose all that apply.
   1. Prevent access to unsanctioned websites
   2. Control all network traffic with a reverse proxy
   3. Control endpoint DLP to unauthorized network shares
   4. Leverage endpoint network traffic for shadow IT discovery
3. True or false: the only ways to determine device state with a Conditional Access App Control session policy are Intune compliance and Hybrid Azure AD join.
   1. True
   2. False
4. You have used the activity log to create a query using the app and activity...

Further reading

If you want to learn even more about MDA, check out the following recommended reading:

• As a general go-to resource for MDA, you should be following Sami Lamppu’s blog, as he regularly shares very interesting articles and discoveries on all things MDA: samilampuu.com.
• You learned about the ability to integrate MDA with external DLP solutions. For a deep dive into configuring it, you should refer to the official documentation: learn.microsoft.com/en-us/defender-cloud-apps/icap-stunnel.
• Want to centralize the management of trusted/named locations? Thijs Lectome has you covered, with this blog on ingesting IP ranges into MDA using Azure Automation: 365bythijs.be/2020/03/31/sync-named-locations-to-mcas-ip-ranges-using-azure-automation/.
• MDA never stays still. Keep on top of the regular changes by monitoring the What’s New? page: learn.microsoft.com/en-us/defender-cloud-apps/release-notes.