Cloud Discovery and shadow IT with Defender for Endpoint
How Cloud Discovery builds a shadow IT inventory from Defender for Endpoint, log collectors and snapshot uploads, how risk scoring and the Unsanctioned and Monitored tags turn into MDE network protection indicators, and how to verify and troubleshoot the block path.
Overview: what Defender for Cloud Apps does and licensing
Defender for Cloud Apps as Microsoft's CASB and SaaS security layer, its four data paths (Cloud Discovery, app connectors, Conditional Access App Control, app governance), the app catalogue and risk scores, how it lands in Defender XDR, what the licences and roles are, and first-time setup.