How Defender for Cloud Apps helps protect your Egnyte environment

Egnyte provides a cloud platform for enterprise file synchronization and sharing, as well as content and data governance. Along with the benefits of effective collaboration in the cloud, your organization's most critical assets may be exposed to threats. Preventing exposure of your critical assets in Egnyte requires continuous monitoring to prevent any malicious actors or security-unaware insiders from exfiltrating sensitive information.

Connecting Egnyte to Defender for Cloud Apps gives you improved insights into your users' activities and provides threat detection for anomalous behavior.

Main threats

  • Compromised accounts and insider threats

  • Insufficient security awareness

  • Unmanaged bring your own device (BYOD)

How Defender for Cloud Apps helps to protect your environment

Control Egnyte with policies

Type Name
Built-in anomaly detection policy Activity from anonymous IP addresses
Activity from infrequent countries/regions
Activity from suspicious IP addresses
Impossible travel
Activity performed by terminated user (requires Microsoft Entra ID as IdP)
Multiple failed login attempts
Activity policy Build a customized policy by the Egnyte activities

For more information about creating policies, see Create a policy.

Automate governance controls

In addition to monitoring for potential threats, you can apply and automate the following Egnyte governance actions to remediate detected threats:

Type Action
User governance Notify user on alert (via Microsoft Entra ID)
Require user to sign in again (via Microsoft Entra ID)
Suspend user (via Microsoft Entra ID)

For more information about remediating threats from apps, see Governing connected apps.

Protect Egnyte in real time

Review our best practices for securing and collaborating with external users and blocking and protecting the download of sensitive data to unmanaged or risky devices.

Connect Egnyte to Microsoft Defender for Cloud Apps

This section describes how to connect Microsoft Defender for Cloud Apps to your existing Egnyte via the App Connector APIs. The resulting connection gives you visibility into and control over your organization's use of Egnyte.

Prerequisites

  • The authorizing user must be one of the following:

    • Power user with can run reports role
    • Administrator
  • Audit reporting must be available in Egnyte's plan

To connect Egnyte to Microsoft Defender for Cloud Apps:

  1. In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps. Under Connected apps, select App Connectors.

  2. In the App connectors page, select +Connect an app, and then select Egnyte.

  3. In the window that appears, give the connector a descriptive name, and then select Next.

  4. In the Enter details page, in Application URL, insert your Egnyte URL by using the following format: https://<domain_name>.egnyte.com

  5. Select Next.

  6. Select Connect Egnyte.

  7. In the redirected page, select Allow.

  8. In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps. Under Connected apps, select App Connectors. Make sure the status of the connected App Connector is Connected.

Note

Microsoft recommends using a short lived access token. Egnyte doesn't currently support short lived tokens. We recommend our customers to refresh the access token every 6 months as a security best practice. To refresh the access token, revoke the old token by following Revoking an oAuth token. Once the old token is revoked, reconnect the Egnyte connector by following the process documented above.

Next steps

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.