Microsoft Defender for Cloud Apps in Microsoft Defender XDR
Applies to:
Microsoft Defender for Cloud Apps is part of Microsoft Defender XDR, and uses the Microsoft Defender portal to allow security admins to perform their security tasks in one location. The Microsoft Defender portal simplifies workflows and combines functionality from other Microsoft Defender XDR services to Defender for Cloud Apps.
The Microsoft Defender portal is the home for monitoring and managing security across your Microsoft identities, data, devices, apps, and infrastructure. SOC analysts can triage, investigate, and hunt across all Microsoft Defender XDR workloads, including cloud apps. For example, Defender for Cloud Apps alerts appear in Microsoft Defender XDR's incidents queue and alerts queue, with relevant content inside the alert pages, in a unified format with the proper adaptations to each alerts type.
All users accessing the classic Microsoft Defender for Cloud Apps portal are automatically rerouted to the Microsoft Defender portal, with no option to opt out. This article is intended for customers moving from the classic Defender for Cloud Apps portal and want to learn more about where to find Defender for Cloud Apps content in the Microsoft Defender portal.
Take a look in Microsoft Defender XDR at https://security.microsoft.com.
Learn more about the benefits: Overview of Microsoft Defender XDR.
Quick reference
The images and the tables below list the changes in navigation between Microsoft Defender for Cloud Apps and Microsoft Defender XDR.
Discover
Defender for Cloud Apps | Microsoft Defender XDR |
---|---|
Cloud Discover dashboard | Cloud apps -> Cloud discovery |
Discovered Apps | tab on Cloud Discovery page |
Discovered resources | tab on Cloud Discovery page |
IP addresses | tab on Cloud Discovery page |
Users | tab on Cloud Discovery page |
Devices | tab on Cloud Discovery page |
Cloud app catalog | Cloud apps -> Cloud app catalog |
Create Cloud Discovery snapshot report | On the Cloud Discovery page, under Actions |
Investigate
Defender for Cloud Apps | Microsoft Defender XDR |
---|---|
Activity log | Cloud apps -> Activity log |
Files | Cloud apps -> Files |
Users and accounts | Assets -> Identities |
Security configuration | available in Microsoft Defender for Cloud |
Identity security posture | Microsoft Defender for Identity's identity security posture assessments |
OAuth apps | Cloud apps -> OAuth apps |
Connected apps | Settings -> Cloud apps -> Connected apps |
Control
Defender for Cloud Apps | Microsoft Defender XDR |
---|---|
Policies | Cloud apps -> Policy management. Note: Microsoft Entra ID Protection policies will be removed gradually from the Cloud apps policies list. To configure alerts from these policies, see Configure Microsoft Entra IP alert service |
Templates | Cloud apps -> Policy templates |
Settings
Defender for Cloud Apps | Microsoft Defender XDR |
---|---|
Settings | Settings -> Cloud apps |
Settings/Governance log | Cloud apps -> Governance log |
Security extensions -> Playbooks | Settings -> Cloud apps |
Security extensions -> SIEM agents | Settings -> Cloud apps |
Security extensions -> External DLP | Settings -> Cloud apps |
Security extensions -> API tokens | Settings -> Cloud apps |
Manage admin access -> Admin roles | Permissions-> Cloud apps-> Roles |
Manage admin access -> Activity privacy permissions | Permissions-> Cloud apps-> Activity privacy permissions |
Exported reports | Reports -> Cloud apps -> Exported reports |
Scoped deployment and privacy | Settings -> Cloud Apps -> Scoped deployment and privacy |
Connected Apps / App connectors | Settings -> Cloud Apps -> Connected apps -> App Connectors |
Conditional Access App Control | Settings -> Cloud apps -> Connected apps -> Conditional Access App Control apps |
IP address ranges | Settings -> Cloud apps |
User groups | Settings -> Cloud apps |
The capabilities on the following pages are fully integrated into Microsoft Defender XDR, and therefore don't have their own standalone experience in Microsoft Defender XDR:
- Settings > Microsoft Entra ID Protection
- Settings > App Governance
- Settings > Microsoft Defender for Identity
What's changed
Learn about the changes that have come with the integration of Defender for Cloud Apps and Microsoft Defender XDR.
Global search
Use the Microsoft Defender portal's global search bar at the top of the page to search for connected apps in Defender for Cloud Apps.
Assets and identities
As part of the creation of a dedicated Assets section that spans the entire Microsoft Defender XDR experience, the Users and Accounts section of Defender for Cloud Apps is rebranded as the Identities section. No changes to functionality are expected.
Related videos
Learn how to protect your cloud apps in Microsoft Defender XDR:
Protecting cloud apps in Microsoft Defender XDR:
Defender for Cloud Apps in Microsoft Defender XDR for customers migrating from the classic portal
Related information
Tip
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for