Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that acts as a gatekeeper between your organization's users and cloud applications. It provides: - Visibility: Discover all cloud apps in use (shadow IT). - Data security: Control data sharing and apply DLP (Data Loss Prevention) policies. - Threat protection: Detect and block malicious activities using UEBA and threat intelligence. - Compliance: Enforce policies for regulatory compliance.

MDCA is natively integrated with Microsoft 365 Defender, Azure Active Directory (Azure AD), and Microsoft Sentinel, making it a central component of the Microsoft security stack.

Traditional network security perimeters (firewalls, proxies) are ineffective for cloud apps because traffic is encrypted (TLS) and users access apps from anywhere. CASBs fill this gap by monitoring API calls and proxy traffic, allowing security teams to enforce policies regardless of user location or device. MDCA specifically leverages Microsoft's vast threat intelligence and identity protection capabilities.

MDCA operates through two primary deployment modes: 1. Log Collector (App Discovery): On-premises or cloud-based agents that collect firewall and proxy logs (e.g., from Palo Alto, Zscaler, or Cisco) and forward them to MDCA for analysis. This helps discover shadow IT. 2. API Connectors: Direct integration with cloud providers (e.g., Microsoft 365, Google Workspace, Salesforce, AWS) via their APIs. This allows MDCA to read metadata and content, apply DLP, and take governance actions (e.g., quarantine files, suspend users).

Additionally, Conditional Access App Control uses reverse proxy architecture. When a user accesses a cloud app, traffic is routed through MDCA's proxy, which can enforce session policies (e.g., read-only, block download) in real time. This requires Azure AD Conditional Access policies to route traffic.

- Cloud Discovery Dashboard: Shows discovered apps, risk scores (1-10), and usage trends. Default data retention is 90 days. - App Risk Score: Based on 80+ risk factors (e.g., encryption, data center location, compliance certifications). Scores range from 1 (least risky) to 10 (most risky). - Policies: Types include: - Access policies: Enforce real-time controls (e.g., block download from unmanaged devices). - Activity policies: Trigger on specific activities (e.g., multiple failed logins). - File policies: Scan files for sensitive content (e.g., credit card numbers) using built-in DLP or custom expressions. - Anomaly detection policies: Built-in UEBA that detects impossible travel, ransomware, etc. - OAuth app policies: Monitor third-party app permissions. - Governance actions: Examples include suspend user, revoke permissions, quarantine file, send email. Actions depend on the app's API capabilities. - Session controls: Supported for major browsers (Edge, Chrome, Firefox) via a browser extension or via Azure AD Conditional Access. Default session timeout is 1 hour. - Log collector: Supports syslog, FTP, or cloud storage (Azure Blob, AWS S3). Default upload interval is every 5 minutes.

In the Microsoft 365 Defender portal, navigate to Cloud Apps > Policies to create policies. For example, to create an activity policy: 1. Go to Policies > Policy management > Create policy > Activity policy. 2. Set Policy name, Severity, and Category. 3. Define Filter (e.g., App = Office 365, Activity = Failed login). 4. Set Governance action (e.g., Suspend user). 5. Enable the policy.

To verify log collection:

Install-Module -Name MSCommerce
Connect-MsolService
Get-MsolCompanyInformation

Install-Module -Name CloudAppSecurity
Install-CloudAppSecurityLogCollector -InstanceName <InstanceName>

A large enterprise with 10,000 employees suspected employees were using unsanctioned cloud file sharing services. They deployed MDCA log collectors on their on-premises firewalls (Palo Alto) and within Azure (using vnet flow logs). Within 24 hours, MDCA discovered 150 distinct cloud apps in use, including personal Dropbox accounts, WeTransfer, and Google Drive. The security team unsanctioned high-risk apps (e.g., those with poor security posture) and created a policy to block access via Conditional Access App Control. They also communicated the approved list (OneDrive, SharePoint) to all employees. This reduced shadow IT by 80% within a month. Performance considerations: Log collectors require adequate CPU/memory on the VM (4 vCPU, 8 GB RAM recommended). Log volume can be high; MDCA processes up to 10 million events per day per collector. Misconfiguration: If the log collector is not properly sized, logs may be dropped, leading to incomplete visibility.

A financial services company needed to prevent credit card numbers from being shared externally via Office 365. They connected MDCA to Office 365 via API and created a file policy that scanned all files in SharePoint Online and OneDrive for Business for PCI-DSS data (credit card numbers). The policy was set to block external sharing of any file containing such data and quarantine the file. Additionally, they applied a sensitivity label 'Confidential' automatically via MDCA's integration with Microsoft Information Protection. The policy was tested on a small group of users first. In production, it blocked 50 sharing attempts in the first week, preventing potential data breaches. Common issue: File policy scanning can take up to 15 minutes for large repositories (over 1 million files). Administrators must ensure the policy filters are efficient to avoid performance impact.

A healthcare organization was targeted by a phishing campaign that compromised a user's credentials. MDCA's anomaly detection policy flagged impossible travel: the user logged in from New York and then from Russia within 5 minutes. The alert was sent to the SOC via Microsoft 365 Defender. The SOC investigated using MDCA's activity log and saw the attacker was downloading patient records from a cloud EHR system. They immediately suspended the user via MDCA's governance action and revoked all active sessions. The incident was then escalated to Microsoft Sentinel for deeper hunting. This scenario highlights the importance of MDCA's UEBA and real-time response. Misconfiguration: If the impossible travel policy threshold is too low (e.g., 10 minutes), it may generate false positives for users with VPNs. Default threshold is 1 hour.