Configuring Microsoft Defender for Cloud Apps

When you move your organization’s apps and services to the cloud, you gain greater flexibility for your users and administrators. However, this is a double-edged sword as a traditional firewall cannot be wrapped around the Microsoft 365 platform. The need to protect your Microsoft 365 apps and services remains absolutely crucial though, and this is where Microsoft Defender for Cloud Apps (MDA) comes in.

MDA is a Cloud Access Security Broker (CASB). CASBs provide you with the visibility and control to protect your organization’s cloud and third-party apps from cyber threats and shadow IT (which is where users feel they do not have the tools to do their jobs, so they look for other, unapproved applications). MDA supports functionalities such as log collection, API connectors, and reverse proxy.

This chapter will cover the following topics:

• Planning your MDA implementation
• Configuring MDA
• Managing Cloud...

Planning your MDA implementation

In this section, you will learn how to plan for and configure MDA. It is a CASB solution designed to provide Microsoft 365 administrators with visibility of all Software-as-a-Service (SaaS) applications within their organization and alert them to risky cloud app usage.

The framework of MDA enables you to discover shadow IT activities (for further information, please refer to the Further reading section at the end of this chapter), as well as identify, classify, and protect sensitive information stored in the cloud. It also detects anomalous behavior within cloud apps to protect you from cyber threats. This in turn helps you ensure that industry standards for security and compliance are applied to your cloud apps to protect them against data leakage.

Note

MDA was previously known as Microsoft Cloud App Security. It is not to be confused with Office 365 Cloud App Security, which is a subset of the features of MDA. Office 365 Cloud App Security...

Configuring MDA

Now that you understand the principles of MDA, take a look at how you can configure it to gain visibility of your SaaS applications. First, you need to be aware of the following prerequisites for using MDA:

• A valid license to use the MDA service. MDA is available with a variety of Microsoft 365 subscriptions. For more information, please refer to the Further reading section at the end of this chapter.
• A Global Administrator or Security Administrator role.

Note

Once access has been assigned with the required licenses and roles, you may need to wait approximately 15 minutes before you can log in to the MDA portal.

Once you have fulfilled these prerequisites, you can proceed to configure your Cloud Discovery settings. To configure MDA, complete the following steps:

1. Log in to the Microsoft 365 Defender portal at https://security.microsoft.com and, from the left menu navigation, choose Settings:

Figure...

Managing Cloud App Discovery

With Cloud App Discovery, you can manually upload traffic logs from your firewall and proxies and analyze for cloud app activity. Additionally, you can automate regular log collection. This is done by completing the following steps:

1. Log in to the MDA portal at https://security.microsoft.com as a Global Administrator or a Security Administrator and navigate to Cloud apps | Cloud Discovery:

Figure 10.4: Cloud Discovery

2. The first thing to do is to create a snapshot report to provide ad hoc visibility into a set of traffic logs you manually upload from your firewalls and proxies. To do this, click on Cloud App Security Proxy and choose Create snapshot report:

Figure 10.5: Creating a snapshot report

3. Enter a report name and description for your report. You also have the Anonymize private information option, as shown in the following screenshot. This should be selected if you...

Managing the MDA catalog

MDA includes a vast app catalog consisting of both native Microsoft 365 and third-party cloud applications. Microsoft assigns a risk score to each of these cloud apps, which you can assess to decide whether to sanction an app for use within your Microsoft 365 environment.

To access the app catalog, carry out the following steps in the MDA portal at https://security.microsoft.com:

1. Navigate to Cloud Apps | Cloud app catalog. Each app has a risk score, and you can mark an app as sanctioned or unsanctioned using the two icons to the right of each app listing, under Actions:

Figure 10.13: Cloud app catalog

2. Clicking on the three dots to the right will also provide you with further actions you can take for the apps in the app catalog, such as tagging apps, app deployment options, and viewing the app score and app details. This is shown in the following screenshot; for more details, please refer to the Further...

Managing apps and app connectors in MDA

You can connect apps in MDA to provide greater visibility by taking the following steps:

1. From the Microsoft 365 Defender portal at https://security.microsoft.com, navigate to Settings | Cloud Apps | Connected Apps | App Connectors. This will take you to the connected apps section, as shown in the following screenshot:

Figure 10.15: Connected apps

2. Click on the Connect an app option. You will be given the option to add connected apps, as shown here:

Figure 10.16: Adding connected apps

3. Select Microsoft Azure to connect to MDA for this example:

Figure 10.17: Connecting an app

4. Click on Connect Microsoft Azure. You will see the following:

Figure 10.18: Connecting an app

5. Click on Done. You will see your connected app in the list of connected apps, as in the following screenshot...

Configuring policies and templates

With MDA policies, you can control your cloud apps with governance and compliance actions. This can be achieved by completing the following steps:

1. From the Microsoft 365 Defender portal, select Cloud apps | Policies, as in the following screenshot:

Figure 10.20: MDA policies

2. Choose Policy management. You will see a list of active MDA policies. These can be filtered by risk category for ease of use, as shown in the following screenshot. From this view, you can choose to view or edit the policy settings by double-clicking on the policy or choosing the cog wheel to the right of the policy. You can also choose to view all matches or alerts for the policy:

Figure 10.21: MDA policy management

3. Viewing all matches for the risky sign-in policy returned the results shown in the following screenshot. From the action menu (the three dots to the right), you can then make...

Using Conditional Access App Control with MDA

MDA can integrate with Azure AD Conditional Access to control access to your Microsoft 365 cloud apps. Conditional Access App Control allows you to specify conditions where users can be informed that their access is being monitored, blocked from downloading content, or forced to use only online web apps.

To view Conditional Access App Control apps, complete the following steps:

1. From the Microsoft 365 Defender portal, go to Settings | Connected Apps and select Conditional Access App Control apps. This takes you to the page shown in the following screenshot, where you can see native Microsoft 365 apps included. It is also possible to add a SAML application from your identity provider:

Figure 10.31: Conditional Access App Control

2. Using the Exchange Online app as an example, create a Conditional Access policy to use session controls. To do this, go to https://portal.azure.com and navigate...

Reviewing and interpreting alerts, reports, and dashboards

With MDA, you can review information on file activity within your cloud applications by completing the following steps:

1. From the Microsoft 365 Defender portal, go to Cloud Apps | Files, as shown in the following screenshot:

Figure 10.36: Investigating files

2. Click on an individual file to see information related to it. Additionally, selecting the three dots next to an individual file item will show you the recent file activity in this area for your cloud apps, such as related alerts and governance, and allow you to apply the required response actions:

Figure 10.37: The available file actions

3. From the same section of the Microsoft 365 Defender portal, you can also access the Activity log:

Figure 10.38: Activity log

4. Use the queries and filters at the top of the activity log to view specific log activity...

Summary

This chapter provided an introduction to MDA. We learned about the two variations of MDA and how Office 365 Cloud App Security is a subset of the broad array of features available in MDA. We learned how MDA can provide visibility of your cloud app usage within your Microsoft 365 environment, both with native Microsoft 365 apps and third-party cloud apps. We also examined how to discover cloud activity by uploading traffic logs from your firewalls and proxies, along with how to sanction and unsanction cloud apps and connect third-party cloud apps using the app connector. The chapter also demonstrated how policies can be applied from built-in templates and policy management creation to control cloud app usage. Finally, we learned how Azure AD Conditional Access can be integrated with MDA using session controls and how to view alerts, file activity, and activity logs.

The next chapter will introduce the features of sensitivity labels in Microsoft Purview. We will learn how...

Questions

1. Which of the following is not a possible application of Conditional Access App Control?
   1. Monitoring access
   2. Blocking uploads
   3. Blocking downloads
2. True or false: Defender for Cloud Apps policies can be used to apply sensitivity labels to content.
   1. True
   2. False
3. Which of the following are names of Defender for Cloud Apps policies? (Choose three)
   1. Access policy
   2. Device compliance policy
   3. File policy
   4. App Protection policy
   5. Activity policy
4. True or false: Office 365 Cloud App Security contains all the features of Microsoft Defender for Cloud Apps.
   1. True
   2. False
5. Where in the MDA portal would you go to sanction or unsanction an app?
   1. Cloud App Control | Policies
   2. Cloud app catalog | Cloud Apps
   3. Cloud Apps | Cloud app catalog
   4. Cloud Discovery | Cloud app catalog
6. When configuring a policy template, which of the following alerts can be configured? (Choose three)
   1. Send alert as email
   2. Send alert via Microsoft Teams
   3. Send alert as text message
   4. Send alert via RSS feed
   5. Send alert to Power Automate
7. Which...

Further reading

Please refer to the following links for more information:

• Top 20 CASB use cases: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3nibJ
• Defender for Cloud Apps overview: https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps
• Comparing Office 365 Cloud App Security and Microsoft Defender for Cloud Apps: https://learn.microsoft.com/en-us/defender-cloud-apps/editions-cloud-app-security-o365?WT.mc_id=EM-MVP-4039827
• Set up Cloud Discovery: https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery
• Add custom apps to Cloud Discovery: https://learn.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-custom-apps?WT.mc_id=EM-MVP-4039827
• Setting up Microsoft Defender for Cloud Apps: https://learn.microsoft.com/en-us/defender-cloud-apps/general-setup?wt.mc_id=4039827
• Cloud App Discovery: https://learn.microsoft.com/en-us/defender-cloud-apps/create-snapshot-cloud-discovery-reports?wt...