Chapter 11: Monitoring Enterprise Apps with Microsoft Defender for Cloud Apps

The previous chapter covered how we can implement enterprise applications into Azure Active Directory (AD) for use with single sign-on (SSO). This included utilizing Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) to discover applications that are being used on your company network. In this chapter, we will look at the advanced tools and capabilities of Microsoft Defender for Cloud Apps to monitor and manage the use of cloud applications in your company.

In this chapter, we're going to cover the following main topics:

• Planning your cloud application strategy
• Implementing cloud app security policies
• Planning and configuring cloud application permissions
• Discovering apps by using a Microsoft Defender for Cloud Apps or an Active Directory Federated Services (ADFS) app report
• Using Microsoft Defender for Cloud Apps to manage application access

...

Technical requirements

In this chapter, we will continue to explore configuring a tenant for the use of Microsoft 365 and Azure. There will be exercises that will require access to Azure AD. If you have not yet created the trial licenses for Microsoft 365, please follow the directions provided within Chapter 1, Preparing for Your Microsoft Exam.

Planning your cloud application strategy

In Chapter 10, Planning and Implementing Enterprise Apps for Single Sign-On (SSO), we discussed how Microsoft Defender for Cloud Apps can help to discover the applications being accessed by users and how we can manage the applications that we want them to use. This included on-premises and cloud applications that we registered for SSO. This chapter will focus more on how to develop a cloud application strategy and the reasons why we would allow or deny certain applications. Let's start by reviewing what Microsoft Defender for Cloud Apps is and how it is used to discover apps being accessed by our users and registered devices.

Discovering apps with Microsoft Defender for Cloud Apps

As mentioned in Chapter 10, Planning and Implementing Enterprise Apps for Single Sign-On (SSO), Microsoft Defender for Cloud Apps is a cloud service with Microsoft 365 that provides cloud access security broker services. A cloud access security broker is...

Implementing cloud app security policies

In the previous sections, we went through the planning process of discovering and identifying applications that can be migrated to Azure AD for SSO. This section goes through the process of configuring an Azure AD application proxy to migrate on-premises applications to Azure AD for authentication and SSO.

Conditional Access policies in Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps allows us to create additional control for cloud apps through policies specific to the cloud apps that we are monitoring. Creating these policies can be done from within the Control menu within the Microsoft Defender for Cloud Apps portal, as shown in Figure 11.4. There are also a number of built-in templates, which can be found under Templates in the Control menu:

Figure 11.4 – Conditional Access policies in Cloud App Security

For more on the use case for creating a Conditional Access policy, please...

Planning and configuring cloud application permissions

The permissions for enterprise applications were discussed in Chapter 10, Planning and Implementing Enterprise Apps for Single Sign-On (SSO), but we will review them again here. There are two primary roles to consider for cloud applications, application administrator and cloud application administrator:

• The application administrator role, which allows users to create and manage enterprise applications, application registrations, and application proxy settings. These administrators can also grant application permissions and delegated permissions.
• The cloud application administrator role can still manage enterprise applications and application registrations, but since this designation is for cloud applications, they do not have the ability to manage application proxies.

When determining the role to assign to an administrator, you should determine whether that administrator is going to be required to manage on...

Discovering apps by using Microsoft Defender for Cloud Apps or an ADFS app report

In this section, we show how to discover third-party applications through Cloud App Security with Microsoft Defender for Cloud Apps reporting and ADFS app reports.

Discovering apps with Microsoft Defender for Cloud Apps app report

Microsoft Defender for Cloud Apps utilizes logs from network traffic to identify the applications that users are accessing. Traffic logs from on-premises firewalls will provide a snapshot report on the most common applications and the users that are accessing these apps. Additional information on app discovery can be found at this link: https://docs.microsoft.com/en-us/cloud-app-security/set-up-cloud-discovery. Traffic from managed devices will be fed into the Microsoft Defender for Cloud Apps Cloud Discovery overview dashboard, as shown in Figure 11.20:

Figure 11.20 – Microsoft Defender for Cloud Apps Cloud Discovery dashboard

This information...

Using Microsoft Defender for Cloud Apps to manage application access

The final area that we need to consider for our application strategy is securing the applications and determining which applications will be allowed or denied access by our users and registered devices.

Discovered app scoring

As a company, you have a responsibility to protect against the sharing of personally identifiable information and company data by users. This includes the potential exposure of this data through unsanctioned cloud applications that are being accessed from devices. Cloud App Security provides an easy-to-follow scoring system for cloud applications, where the level of protection that each app provides has a score based on GENERAL, SECURITY, COMPLIANCE, and LEGAL criteria. Figure 11.23 shows the scoring for Microsoft Office Online:

Figure 11.23 – Microsoft Office Online score

Sanctioning and unsanctioning apps

Once you have evaluated the applications that...

Summary

In this chapter, we covered the use of third-party cloud applications within our organization, and how to manage, monitor, and control them with Cloud App Security. This included how to create app policies and discover apps to sanction or unsanction on a Microsoft tenant. In the next chapter, we will discuss entitlement management and managing the terms of use for users.