Microsoft Defender for Cloud Apps Administration

Microsoft Defender for Cloud Apps (MCAS) is a Cloud Access Security Broker (CASB) that acts as a gateway between users and cloud applications. It provides four core capabilities: discovery, protection, detection, and remediation. Unlike a simple firewall, MCAS operates at the application layer and can inspect and control traffic to sanctioned and unsanctioned cloud apps.

Traditional network security perimeters are ineffective for SaaS applications because traffic often bypasses corporate networks (e.g., users accessing from home or mobile). MCAS addresses this by monitoring cloud app usage via API connectors and reverse proxy. It solves shadow IT, data exfiltration, and compromised account threats.

MCAS operates in two primary modes: read-only and real-time control. Read-only mode uses API connectors to pull activity logs and data from connected apps (e.g., Office 365, Salesforce). Real-time control uses a reverse proxy (Conditional Access App Control) to intercept and modify user sessions.

#### API Connectors

API connectors are the backbone of MCAS. They authenticate to supported apps using OAuth or app-specific tokens. Once connected, MCAS continuously fetches:

The default polling interval is 15 minutes for most apps, but critical alerts can be triggered in near real-time via webhooks. For example, when a user downloads 100 files in 5 minutes, MCAS can raise an alert within seconds.

#### Conditional Access App Control (CAAC)

CAAC uses a reverse proxy architecture. When a user accesses a managed app (e.g., Salesforce), Azure AD Conditional Access routes the session through MCAS. The user's browser is redirected to MCAS's proxy, which decrypts and inspects HTTPS traffic. MCAS can then:

The session is proxied using TLS interception. MCAS re-encrypts traffic with its own certificate, which must be trusted by client devices. This introduces a latency overhead of approximately 50-200 ms per request.

To connect an API connector via PowerShell:

Connect-MsolService
New-MsolServicePrincipal -DisplayName "MCAS-Connector" -Usage "Connector"

To verify MCAS integration with Azure AD:

Get-AzureADPolicy | Where-Object {$_.Definition -like "*MCAS*"}

For session control, you must create a Conditional Access policy in Azure AD:

{
  "conditions": {
    "applications": {
      "includedApplications": ["Salesforce"]
    }
  },
  "grantControls": {
    "builtInControls": ["mcas"],
    "authenticationStrength": "mfa"
  }
}

A company with 5,000 employees suspects employees are using unsanctioned file-sharing apps like Dropbox and WeTransfer. The network team enables Cloud Discovery by configuring the log collector to receive firewall logs from the corporate firewall (Fortinet). Within 24 hours, MCAS identifies 47 cloud apps in use, with Dropbox being the top unsanctioned app by traffic volume. The security team creates a policy to alert when any unsanctioned app with a risk score below 5 is used. They also block high-risk apps like a known malware-hosting service. The challenge is log volume: the firewall generates 10 million logs per day. The log collector must be sized with adequate CPU and memory (4 vCPU, 8 GB RAM recommended). Misconfiguration can cause log parsing failures, leading to incomplete data.

A financial services firm uses Salesforce to store customer PII. They enable MCAS API connector for Salesforce and create a file policy that detects files containing social security numbers (SSN). When a user downloads a file with SSN, MCAS automatically quarantines the file and alerts the security team. They also deploy session control via Conditional Access App Control to block downloads of any file tagged as 'Confidential' from unmanaged devices. Performance is a consideration: the reverse proxy adds latency, so they exempt low-risk apps from session control. A common mistake is forgetting to trust the MCAS certificate on client devices, causing TLS errors for users.

A user's credentials are compromised via phishing. The attacker logs in from an IP in Russia, while the user is in the US. MCAS's impossible travel policy fires because the two sign-ins occurred 30 minutes apart (distance > 500 miles). The alert is raised within minutes. The security team investigates and sees the attacker downloaded 200 files from SharePoint. They immediately use the 'Suspend user' governance action, which disables the account in Azure AD within 5 minutes. The team also revokes all OAuth tokens for that user. The key metric is alert latency: API-based detection takes up to 15 minutes, but session-based detection is real-time. In this case, the initial sign-in was via the proxy, so detection was immediate.