Edit

Connect Slack to Microsoft Defender for Cloud Apps

  • Article
  • 2 minutes to read

Note

Microsoft Defender for Cloud Apps (previously known as Microsoft Cloud App Security) is now part of Microsoft 365 Defender. The Microsoft 365 Defender portal allows security admins to perform their security tasks in one location. This will simplify workflows, and add the functionality of the other Microsoft 365 Defender services. Microsoft 365 Defender will be the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. For more information about these changes, see Microsoft Defender for Cloud Apps in Microsoft 365 Defender.

This article provides instructions for connecting Microsoft Defender for Cloud Apps to your existing Slack using the App Connector APIs. This connection gives you visibility into and control over your organization's Slack use.

Prerequisites

  • Your Slack tenant must meet the following requirements:

    • Your Slack tenant must have an Enterprise license. Defender for Cloud Apps doesn't support non-enterprise licenses.
    • Your Slack tenant should have Discovery API enabled. To enable Discovery API for your Slack tenant, contact Slack support.

  • The org Owner needs to be logged into their Slack organization within their browser before installing the connector.

How to connect Slack to Defender for Cloud Apps

  1. In the Defender for Cloud Apps portal, select Investigate and then Connected apps.

  2. In the App connectors page, select the plus button followed by Slack.

  3. In the pop-up, give the connector a descriptive name, and press Connect.

    Connect Slack.

  4. In the next screen, select Connect in Slack.

    Connect in Slack.

  5. You'll be redirected to the Slack page. Make sure the org Owner is already logged into the Slack organization.

  6. In the Slack Authorization page, make sure to choose the correct organization from the dropdown in the top-right corner.

    Note

    • The first connection can take up to 4 hours to get all users and their activities in the 7 days before the connection.
    • After the connector's Status is marked as Connected, the connector is live and works.
    • The received activities are from the Slack Audit Log API. You can find them in the Slack documentation.
    • Send Slack message activity is an activity that can be received from Conditional Access App Control, and not from the Slack API connector.

Next steps

Control cloud apps with policies

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.