Issue Blocking SaaS Apps with Microsoft Defender for Cloud Apps

Question

Issue Blocking SaaS Apps with Microsoft Defender for Cloud Apps

AZ Qureshi 0

I want to block SaaS apps using Microsoft Defender for business. I used tags, created a device group on Defender, and added 2 devices to it using tags. In Defender settings, I went to Advanced Features and enabled Microsoft Defender for Cloud Apps. I blocked WordReference(dot)com for testing purposes and applied the policy to the group I had created. However, even after 4 hours, the devices in this group can still access the website.

What configuration step am I missing? I am currently working on pre-test devices, which is why there are only two devices in the group.

Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-07-26T08:18:43.1633333+00:00

@AZ Qureshi Thank you for reaching out to us, just check if the below links helps to achieve your ask

https://jeffreyappel.nl/block-apps-discovered-shadow-it-with-defender-for-cloud-apps-and-defender-for-endpoint/

https://learn.microsoft.com/en-us/defender-cloud-apps/mde-govern

https://learn.microsoft.com/en-us/defender-cloud-apps/access-policy-aad

Feel free to post back, if the above links doesn't help.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-07-29T06:20:56.31+00:00

@AZ Qureshi Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
AZ Qureshi 0 Reputation points

2024-07-31T15:35:21.5833333+00:00
Hi @Givary-MSFT

I went through the first two links and have configured exactly what is mentioned in the document, except I did not configure "Custom network indicators" because this option breaks everything on my network (lab LAN).

I can see the following licenses, but I am not sure if I need another license to manage access to the applications using Microsoft Defender Cloud Apps:

M365 - Exchange Online (Plan 1)

Microsoft 365 E3 + Microsoft Defender for Endpoint Plan 1

Microsoft 365 E5 + Microsoft Defender for Endpoint

Still having the same issue