defender-for-cloud-apps

Name: defender-for-cloud-apps
Author: vinayaklatthe

54installs34forks

How to install defender-for-cloud-apps?

vinayaklatthe/microsoft-security-skills/defender-for-cloud-apps

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps

Installs into the current project.

Summary

Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection. Covers Cloud Discovery via Defender for Endpoint integration, OAuth app governance, Conditional Access App Control (reverse-proxy session po

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Cloud Apps
2
3	Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS
4	security solution providing visibility into cloud app usage, governance of OAuth-connected
5	apps, real-time session controls via Conditional Access App Control, and threat detection
6	across connected SaaS services.
7
8	## When to use
9	Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session
10	controls, and managing SaaS posture (SSPM). Use this skill when the question is about
11	applications (SaaS or third-party), not IaaS or endpoints.
12
13	Do not use this skill for IaaS / PaaS posture (`defender-for-cloud-hardening`), EDR
14	(`defender-for-endpoint`), or DLP authoring (`purview-dlp-policy`).
15
16	## Pick the MDA capability
17
18	\| Goal \| Capability \| Notes \|
19	\|---\|---\|---\|
20	\| Find unsanctioned cloud apps in use \| Cloud Discovery via MDE integration \| Agentless; uses MDE telemetry \|
21	\| Get activity / file visibility for sanctioned SaaS \| App connector (API-based) \| M365, Salesforce, ServiceNow, Workday \|
22	\| Govern OAuth apps connected to Microsoft 365 \| App governance add-on \| Risk score + automated policies \|
23	\| Block file download in browser session \| Conditional Access App Control (session) \| Reverse proxy; integrates with CA \|
24	\| Detect anomalous user activity (impossible travel, mass download) \| Anomaly detection policies \| UEBA-style \|
25	\| Posture for connected SaaS (config drift) \| SaaS Security Posture Management (SSPM) \| Per-app recommendations \|
26	\| Investigate / contain a compromised SaaS account \| Governance actions \| Suspend, force re-auth, revoke OAuth \|
27
28	> Rule of thumb: start with Cloud Discovery via MDE (free with E5) to find shadow IT
29	> and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session
30	> control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it
31	> narrowly.
32
33	## Approach
34
35	1. Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on.
36	No agents, no log uploads - discovery happens automatically from MDE telemetry on
37	managed endpoints.
38	Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.
39
40	2. Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved
41	apps; unsanction risky / unused apps (MDE then blocks them on managed endpoints).
42	Verify: top 10 high-user-count high-risk apps reviewed weekly.
43
44	3. Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow,
45	Workday, GitHub Enterprise via API connector. Provides activity log, file inventory,
46	admin / user account governance.
47
48	4. Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS
49	blast radius. App governance scores third-party OAuth apps by risk and permission
50	privilege. Auto-policy: block apps requesting > X high-privilege permissions or
51	unverified publisher.
52	*Verify: app governance shows risk distribution; high-risk apps either approved or
53	blocked, not lingering.*
54
55	5. Conditional Access App Control - pilot session policies — Reverse-proxy session
56	control for browser sessions to cloud apps. Use cases: block download on unmanaged
57	devices, force document-labeling on upload, monitor copy/paste.
58	*Verify: a session from an unmanaged device shows the watermark / download block; from
59	a compliant device, no friction.*
60
61	6. Anomaly detection + alert tuning — Default policies (impossible travel, mass
62	download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to
63	Defender XDR for unified incident view.
64
65	7. Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the
66	top 5 alert types (impossible travel, mass download, OAuth consent granted, file
67	externally shared, admin activity from unusual location).
68
69	## Guardrails
70	- **Cloud Discovery data can include user activity - set anonymisation per privacy
71	requirements.** EU works councils may require user anonymisation in the discovery view.
72	- **Pilot session policies; reverse-proxy

People who liked this also viewed

6 picks

Type

defender-for-cloud-apps

54installs34forks

View on GitHub

How to install defender-for-cloud-apps?

vinayaklatthe/microsoft-security-skills/defender-for-cloud-apps

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Cloud Apps
2
3	Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS
4	security solution providing visibility into cloud app usage, governance of OAuth-connected
5	apps, real-time session controls via Conditional Access App Control, and threat detection
6	across connected SaaS services.
7
8	## When to use
9	Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session
10	controls, and managing SaaS posture (SSPM). Use this skill when the question is about
11	applications (SaaS or third-party), not IaaS or endpoints.
12
13	Do not use this skill for IaaS / PaaS posture (`defender-for-cloud-hardening`), EDR
14	(`defender-for-endpoint`), or DLP authoring (`purview-dlp-policy`).
15
16	## Pick the MDA capability
17
18	\| Goal \| Capability \| Notes \|
19	\|---\|---\|---\|
20	\| Find unsanctioned cloud apps in use \| Cloud Discovery via MDE integration \| Agentless; uses MDE telemetry \|
21	\| Get activity / file visibility for sanctioned SaaS \| App connector (API-based) \| M365, Salesforce, ServiceNow, Workday \|
22	\| Govern OAuth apps connected to Microsoft 365 \| App governance add-on \| Risk score + automated policies \|
23	\| Block file download in browser session \| Conditional Access App Control (session) \| Reverse proxy; integrates with CA \|
24	\| Detect anomalous user activity (impossible travel, mass download) \| Anomaly detection policies \| UEBA-style \|
25	\| Posture for connected SaaS (config drift) \| SaaS Security Posture Management (SSPM) \| Per-app recommendations \|
26	\| Investigate / contain a compromised SaaS account \| Governance actions \| Suspend, force re-auth, revoke OAuth \|
27
28	> Rule of thumb: start with Cloud Discovery via MDE (free with E5) to find shadow IT
29	> and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session
30	> control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it
31	> narrowly.
32
33	## Approach
34
35	1. Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on.
36	No agents, no log uploads - discovery happens automatically from MDE telemetry on
37	managed endpoints.
38	Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.
39
40	2. Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved
41	apps; unsanction risky / unused apps (MDE then blocks them on managed endpoints).
42	Verify: top 10 high-user-count high-risk apps reviewed weekly.
43
44	3. Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow,
45	Workday, GitHub Enterprise via API connector. Provides activity log, file inventory,
46	admin / user account governance.
47
48	4. Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS
49	blast radius. App governance scores third-party OAuth apps by risk and permission
50	privilege. Auto-policy: block apps requesting > X high-privilege permissions or
51	unverified publisher.
52	*Verify: app governance shows risk distribution; high-risk apps either approved or
53	blocked, not lingering.*
54
55	5. Conditional Access App Control - pilot session policies — Reverse-proxy session
56	control for browser sessions to cloud apps. Use cases: block download on unmanaged
57	devices, force document-labeling on upload, monitor copy/paste.
58	*Verify: a session from an unmanaged device shows the watermark / download block; from
59	a compliant device, no friction.*
60
61	6. Anomaly detection + alert tuning — Default policies (impossible travel, mass
62	download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to
63	Defender XDR for unified incident view.
64
65	7. Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the
66	top 5 alert types (impossible travel, mass download, OAuth consent granted, file
67	externally shared, admin activity from unusual location).
68
69	## Guardrails
70	- **Cloud Discovery data can include user activity - set anonymisation per privacy
71	requirements.** EU works councils may require user anonymisation in the discovery view.
72	- **Pilot session policies; reverse-proxy

People who liked this also viewed

6 picks

Type