In short: Microsoft Defender for Cloud Apps, formerly Microsoft Cloud App Security, is Microsoft's CASB. It discovers shadow IT, connects to SaaS apps by API to detect threats and posture issues, governs OAuth apps, and controls browser sessions through Conditional Access App Control. It is part of Defender XDR and included in Microsoft 365 E5 and the Microsoft Defender Suite.
What Defender for Cloud Apps does
Defender for Cloud Apps brings the main CASB functions into the Microsoft Defender portal, where its alerts are correlated with endpoint, email and identity signals in Microsoft Defender XDR incidents. Microsoft groups its capabilities into four areas:
- Core CASB functions: shadow IT discovery, cloud app usage visibility, protection against app-based threats and compliance assessment
- SaaS security posture management (SSPM): misconfiguration findings and recommendations for connected apps, surfaced in Microsoft Secure Score
- Advanced threat protection: behavioural analytics and anomaly detection, such as impossible travel, mass download and suspicious inbox rules
- App-to-app protection: app governance for OAuth apps that hold permissions to your data
It was previously called Microsoft Cloud App Security, so older documentation and licence names may still use that term.
Shadow IT discovery
Cloud Discovery identifies the cloud apps in use across your organisation, on and off the corporate network, and assesses each against more than 90 risk indicators from Microsoft's cloud app catalogue. Data can come from:
- Native Microsoft Defender for Endpoint integration, the simplest route: devices onboarded to Defender for Endpoint report cloud app use wherever they are, with no log collector
- Automatic log upload from your firewall or proxy through a log collector
- Manual log upload for a one-off assessment
Once you can see the apps, you can sanction approved ones and mark others as unsanctioned. With Defender for Endpoint, unsanctioned apps can be blocked on the device itself, without a separate proxy. This is also an effective way to see which generative AI tools staff are using; see securing staff use of generative AI.
App connectors, app governance and OAuth apps
App connectors use each provider's API to give deeper visibility and control in sanctioned apps, such as Microsoft 365, Google Workspace, Salesforce, Box, Dropbox and others. Through connectors you get activity logs, threat detections, user and file governance actions, and SSPM recommendations.
App governance focuses on OAuth apps: third-party and custom applications that users or admins have consented to, which can read mail, files or calendars on a user's behalf. It flags highly privileged, overprivileged and unused apps, monitors credentials, and can disable a misbehaving app. Consent phishing, where an attacker tricks a user into granting a malicious app access, bypasses passwords and MFA entirely, so this is a valuable control for any Microsoft 365 tenant.
Session control with Conditional Access App Control
Conditional Access App Control applies real-time controls to browser sessions, which is ideal for unmanaged devices and partner users because nothing is installed on the device. Entra conditional access routes the session to Defender for Cloud Apps, and policies can then:
- Block download, cut, copy and print of sensitive documents on unmanaged devices
- Protect on download by applying a sensitivity label and encryption instead of blocking
- Block upload of unlabelled sensitive files, or of files identified as malware
- Require step-up authentication when a sensitive action happens in the session
- Monitor sessions for investigation and policy design
Microsoft Edge for Business users get in-browser protection without being redirected (Microsoft still labels this preview); other supported browsers are redirected through a reverse proxy, shown by an mcas.ms suffix added to the address. Session controls apply to browser sessions only, so Microsoft advises using access policies to block native desktop and mobile clients for the same users if you need the policy to hold. The Microsoft Teams desktop app, for example, is not covered by session controls.
File policies are moving to Microsoft Purview
Microsoft is moving file-based data protection out of Defender for Cloud Apps. File policies retire on 6 January 2027, and Microsoft asks customers to recreate them as Microsoft Purview data loss prevention or auto-labelling policies before then. Defender for Cloud Apps continues to provide discovery, posture management and threat detection.
What this means in practice:
- A DLP to Purview migration tool in the Defender portal groups existing file policies as can migrate, partial migration or cannot migrate, and creates equivalent Purview policies in test mode
- Purview DLP can cover non-Microsoft apps such as Google Workspace, Box, Dropbox and Salesforce through the existing app connectors, with that support in preview and rolling out in phases at the time of writing; the migration tool does not yet move these policies, so they are recreated by hand
- Some governance actions, such as expiring a shared link, deleting a file or transferring file ownership, have no direct Purview equivalent and need another approach, such as SharePoint sharing policies or Power Automate
- Equivalent policies should not run in both products at once; validate in Purview, turn enforcement on, then disable the old file policy
Our Microsoft Purview page covers DLP and sensitivity labels in depth. If you rely on file policies today, we can review and migrate them for you.
Licensing, and when a third-party CASB is better
Defender for Cloud Apps is included in Microsoft 365 E5 and in the Microsoft Defender Suite (formerly Microsoft 365 E5 Security), which Business Premium and E3 customers can add, and it is also sold standalone. Some Office 365 plans include Office 365 Cloud App Security instead, a subset that supports only the Office 365 app connector and manual log upload for discovery. For agreements and bundles see Forever Group's Microsoft licensing team; pricing depends on your licences, so ask us for a quote.
| Defender for Cloud Apps suits you if | Consider a third-party CASB, SSE or browser if |
|---|---|
| You already own E5 or the Microsoft Defender Suite | You hold neither and only need basic discovery |
| Devices are onboarded to Defender for Endpoint | Many users are on unmanaged devices you cannot onboard |
| Your SOC works in the Defender portal | You want CASB in the same console as your web gateway and ZTNA |
| Most SaaS data is in Microsoft 365 | You need deep inline control across many non-Microsoft apps |
See the alternatives on our CASB page, including Cisco Umbrella CASB and Island Enterprise Browser. Contact us to switch on and tune what you already own.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft Defender for Cloud Apps the same as Microsoft Cloud App Security?
Yes. Microsoft Cloud App Security was renamed Microsoft Defender for Cloud Apps and now lives in the Microsoft Defender portal as part of Defender XDR. Office 365 Cloud App Security is a separate, more limited subset that supports only the Office 365 app connector.
Which licences include Defender for Cloud Apps?
It is included in Microsoft 365 E5 and in the Microsoft Defender Suite (formerly Microsoft 365 E5 Security), which can be added to Business Premium or E3. It is also available standalone. Business Premium on its own does not include the full product.
Are Defender for Cloud Apps file policies being retired?
Yes. Microsoft retires file policies on 6 January 2027 and recommends recreating them as Microsoft Purview DLP or auto-labelling policies. A migration tool in the Defender portal helps move eligible policies. Discovery, posture management and threat detection continue.
What is Conditional Access App Control?
It is the session control feature of Defender for Cloud Apps. Entra conditional access routes browser sessions through Defender for Cloud Apps, which can block downloads, copy and print, apply labels on download or block risky uploads, in real time and without installing anything on the device.
Can Defender for Cloud Apps block unsanctioned apps?
Yes. If devices are onboarded to Microsoft Defender for Endpoint, apps you mark as unsanctioned in Defender for Cloud Apps can be blocked on the device itself, wherever the user is working, without a separate proxy.