Overview: what Defender for Cloud Apps does and licensing
Defender for Cloud Apps as Microsoft's CASB and SaaS security layer, its four data paths (Cloud Discovery, app connectors, Conditional Access App Control, app governance), the app catalogue and risk scores, how it lands in Defender XDR, what the licences and roles are, and first-time setup.
Cloud Discovery and shadow IT with Defender for Endpoint
How Cloud Discovery builds a shadow IT inventory from Defender for Endpoint, log collectors and snapshot uploads, how risk scoring and the Unsanctioned and Monitored tags turn into MDE network protection indicators, and how to verify and troubleshoot the block path.
Conditional Access App Control and session policies
How Defender for Cloud Apps takes over a browser session from Entra Conditional Access, through the mcas.ms reverse proxy or Edge for Business in-browser protection, and how access and session policies block downloads, uploads, copy, paste and print on unmanaged devices.
App governance and OAuth app risk
How app governance in Defender for Cloud Apps inventories OAuth apps registered in Entra ID, Google Workspace and Salesforce, scores their permissions and data usage, detects consent phishing and anomalous app behaviour, and how it fits with Entra user consent settings and the admin consent workflow.
Policies, anomaly detection, alerts and troubleshooting
The eight Defender for Cloud Apps policy types, what the built-in anomaly detections flag and how to scope them, file policies with Purview labels, per-app governance actions, the activity log, the alert lifecycle in Defender XDR, Sentinel paths, the Activities and Alerts API, and a troubleshooting table for the whole product.