Get started with Microsoft Defender for Cloud Apps
Article
This quickstart describes how to start working with Microsoft Defender for Cloud Apps on the Microsoft Defender Portal.
Defender for Cloud Apps can help you use the benefits of cloud applications while maintaining control of your corporate resources. Defender for Cloud Apps improves your visibility into cloud activity and helps increase protection over your corporate data.
Tip
As a companion to this article, we recommend using the Microsoft Defender for Cloud Apps automated setup guide when signed in to the Microsoft 365 admin center. This guide will customize your experience based on your environment. To review best practices without signing in and activating automated setup features, go to the Microsoft 365 setup portal.
Prerequisites
To set up Defender for Cloud Apps, you must at least be a Security Administrator in Microsoft Entra ID or Microsoft 365.
Microsoft Defender for Cloud Apps depends on the following Microsoft Entra ID applications to function properly. Do not disable these applications in Microsoft Entra ID:
Microsoft Defender for Cloud Apps - APIs
Microsoft Defender for Cloud Apps - Customer Experience
Microsoft Defender for Cloud Apps - Information Protection
Microsoft Defender for Cloud Apps - MIP Server
Access Defender for Cloud Apps
Obtain a Defender for Cloud Apps license for each user you want protected by Defender for Cloud Apps. For more information, see the Microsoft 365 licensing datasheet.
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under Connected Apps, select App Connectors.
Select the +Connect an app to add an app and then select an app.
Follow the configuration steps to connect the app.
Why connect an app?
After you connect an app, you can gain deeper visibility so you can investigate activities, files, and accounts for the apps in your cloud environment.
Step 2: Protect sensitive information with DLP policies
You can view files from your connected apps by browsing to Cloud Apps > Files in the Microsoft Defender Portal.
Migration recommendation
We recommend using Defender for Cloud Apps sensitive information protection in parallel with your current Cloud Access Security Broker (CASB) solution. Start by connecting the apps you want to protect to Microsoft Defender for Cloud Apps. Since API connectors use out-of-band connectivity, no conflict will occur. Then progressively migrate your policies from your current CASB solution to Defender for Cloud Apps.
Note
For third-party apps, verify that the current load does not exceed the app's maximum number of allowed API calls.
In the Microsoft Defender Portal, under Cloud Apps, choose Policies -> Policy templates.
Choose a policy template from the list, and then select the + icon to create the policy.
Customize the policy (select filters, actions, and other settings), and then choose Create.
Under Cloud Apps, choose Policies -> Policy management, to choose the policy and see the relevant matches (activities, files, alerts).
Tip
To cover all your cloud environment security scenarios, create a policy for each risk category.
How can policies help your organization?
You can use policies to help you monitor trends, see security threats, and generate customized reports and alerts. With policies, you can create governance actions, and set data loss prevention and file-sharing controls.
To achieve full coverage, create a continuous cloud discovery report
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under Cloud Discovery, choose Automatic log upload.
On the Data sources tab, add your sources.
On the Log collectors tab, configure the log collector.
Migration recommendation
We recommend using Defender for Cloud Apps discovery in parallel with your current CASB solution. Start by configuring automatic firewall log upload to Defender for Cloud Apps log collectors. If you use Defender for Endpoint, in Microsoft Defender XDR, make sure you turn on the option to forward signals to Defender for Cloud Apps. Configuring cloud discovery won't conflict with the log collection of your current CASB solution.
To create a snapshot cloud discovery report
In the Microsoft Defender Portal, under Cloud Apps, choose Cloud discovery.
In the top right-hand corner, select Actions -> Create Cloud Discovery snapshot report.
Why should you configure cloud discovery reports?
Having visibility into shadow IT in your organization is critical.
After your logs are analyzed, you can easily find which cloud apps are being used, by which people, and on which devices.
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under System, select Mail settings.
Under Email sender identity, enter your email addresses and display name.
Under Email design, upload your organization's email template.
To set admin notifications
In the Microsoft Defender Portal, select Settings. Then choose Microsoft Defender XDR.
Select Email notifications.
Configure the methods you want to set for system notifications.
To customize the score metrics
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under Cloud Discovery, choose Score metrics.
Configure the importance of various risk values.
Choose Save.
Now the risk scores given to discovered apps are configured precisely according to your organization needs and priorities.
Why personalize your environment?
Some features work best when they're customized to your needs.
Provide a better experience for your users with your own email templates. Decide what notifications you receive and customize your risk score metric to fit your organization's preferences.
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under System, select IP address ranges.
Select + Add IP address range to add an IP address range.
Enter the IP range Name, IP address ranges, Category, and Tags.
Choose Create.
Now you can use IP tags when you create policies, and when you filter and create continuous reports.
To create continuous reports
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under Cloud Discovery, choose Continuous reports.
Choose Create report.
Follow the configuration steps.
Choose Create.
Now you can view discovered data based on your own preferences, such as business units or IP ranges.
To add domains
In the Microsoft Defender Portal, select Settings. Then choose Cloud Apps.
Under System, choose Organization details.
Add your organization's internal domains.
Choose Save.
Why should you configure these settings?
These settings help give you better control of features in the console. With IP tags, it's easier to create policies that fit your needs, to accurately filter data, and more. Use Data views to group your data into logical categories.
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that operates on multiple clouds. It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyberthreats across all your cloud services. Learn how to use Defender for Cloud Apps in your organization.