Defender for Cloud Apps Licensing: Standalone, E5 or Defender Suite

Every price below is per user per month on an annual commitment, Commercial segment, Microsoft list price, October 2026 price list. Microsoft publishes annual figures; $42.00 per year ÷ 12 = $3.50 per month, and the same division produces every other number in the table.

Two notes on the names. Microsoft renamed Microsoft 365 E5 Security to Microsoft Defender Suite on 1 October 2025; the contents did not change. The product itself was Microsoft Cloud App Security until Microsoft renamed it Microsoft Defender for Cloud Apps in November 2021, which is why the old name still brings people to this page and to our deployment guide.

The decision depends on the base plan, not on the size of the company.

Microsoft 365 Business Premium ($22.00). Business Premium carries Defender for Business and Defender for Office 365 Plan 1, not Defender for Cloud Apps. Two options: add the standalone license at $3.50 per user, which gives the complete product because Business Premium already includes the Entra ID P1 that session controls need; or add the Microsoft Defender Suite for Business Premium, which brings Defender for Cloud Apps together with Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity and Entra ID P2 for tenants of up to 300 users. The add-on is not on the October 2026 sheet, so we quote it on request. Pick standalone when the cloud app problem is the only gap; pick the Suite when you also run on-premises Active Directory (Defender for Identity) or want hunting on endpoints.

Microsoft 365 E3 ($39.00). E3 has Entra ID P1 and Defender for Endpoint P1, and no Defender for Cloud Apps. Standalone at $3.50 is the CASB-only answer. The Microsoft Defender Suite at $12.00 is the answer when you want the five products: bought one by one on the same sheet they are Defender for Cloud Apps $3.50, Defender for Identity $5.50, the Defender for Endpoint P2 add-on for E3 $3.00, the Defender for Office 365 P2 add-on $3.00 and the Entra P2 add-on $3.00, which is $18.00. The E5 add-ons article runs the full E5 comparison.

Microsoft 365 E5 ($60.00) and EMS E5 ($18.00). Nothing to buy. The work is to turn it on: in many E5 tenants we open, the Microsoft 365 app connector was never connected.

Office 365 E3, Business Standard, Business Basic. The standalone license attaches to any of these. Discovery, app connectors, file policies and app governance work. Session controls need Entra ID P1 ($7.00), which these plans do not include.

Buyers compare CASB products by their feature lists and miss that the Microsoft product is three tools under one license.

App discovery (Cloud Discovery). Defender for Cloud Apps reads traffic logs from your firewall or proxy, or takes the signal straight from Defender for Endpoint on each device, and matches it against a catalog of more than 33,000 cloud apps scored on more than 90 risk factors (Microsoft product page). The output is who uses what and how much data goes there. With Defender for Endpoint on the device, you can mark an app unsanctioned and the endpoint blocks it; the shadow AI article covers the generative AI case.

App governance (OAuth apps). Separate from the apps people browse to are the apps people consent to: the "Sign in with Microsoft" buttons that ask for mailbox or files permissions. App governance inventories every OAuth app registered against Entra ID, Google Workspace and Salesforce, scores its permissions and usage, and can disable it. Microsoft folded app governance into the Defender for Cloud Apps license on 1 June 2023; it was an add-on before that, and some older quotes still list it separately.

Session controls (Conditional Access App Control). Entra ID Conditional Access routes a sign-in through Defender for Cloud Apps, which then watches the session and can block downloads, uploads, copy and print on an unmanaged device, or apply a sensitivity label on download. This needs both licenses: Defender for Cloud Apps and Entra ID P1. Business Premium, E3 and E5 have P1; Office 365 and Business Standard tenants need to add it.

App connectors and posture. The fourth piece is the API connection to each SaaS platform, which is what file policies, activity policies and the SaaS security posture assessments run on. Connect Microsoft 365 first; it takes minutes.

List prices, annual commitment, October 2026 price list.

The rule that falls out: if Defender for Cloud Apps is the only product missing, buy it alone. If two or more of the other four Suite products are also missing, the Suite at $12.00 is less than the pieces, and the E5 step is only worth taking when the Purview Suite, Teams Phone or Power BI Pro are on the same list. Licenses are the customer's own Microsoft subscription; the implementation project is quoted separately.

Every one of these starts in alert-only mode. Blocking comes after two weeks of reading what the alerts say.

1. A Cloud Discovery policy for new risky apps. Alert when an app with a risk score of 3 or lower is used by more than five users or receives more than 50 MB of uploads in a day. Review the list weekly, sanction or unsanction, and let Defender for Endpoint enforce the unsanctioned list.
2. An OAuth app policy in app governance. Alert on any newly consented app that asks for mailbox, files or directory write permissions and was consented by a non-administrator. Turn on the Entra ID admin consent workflow at the same time, so users request rather than grant.
3. The built-in anomaly detection policies, scoped. Impossible travel, activity from an infrequent country, mass download, ransomware activity and multiple failed sign-ins are already on. Week one is for scoping them to the right groups and setting the sensitivity so the alert count is one you will read.
4. A file policy for external sharing of sensitive content. Match files in SharePoint and OneDrive shared with anyone or with an external domain that contain a credit card number, a US Social Security number or your own sensitive information type. The governance action is to remove external users, with a notification to the owner.
5. A session policy for unmanaged devices. With a Conditional Access policy that routes browser sessions through Defender for Cloud Apps, block download of files labeled Confidential on devices that are not Intune-compliant. This is the policy that turns a stolen password into a read-only session.

The deployment guide carries the click paths for each of these.

The portal question comes up because the product moved. Defender for Cloud Apps is administered in the Microsoft Defender portal at security.microsoft.com, under Cloud apps, alongside Defender for Endpoint, Defender for Office 365 and Defender for Identity; alerts land in the same incident queue, so one investigation can show the risky OAuth app, the mailbox rule it created and the device it came from.

Connected apps are the app connectors: Settings, Cloud apps, App connectors, then the platform. Microsoft 365 is the one every tenant needs, and it covers Exchange Online, SharePoint, OneDrive, Teams and Entra ID activity. Google Workspace, Salesforce, Box, Dropbox, ServiceNow, Okta and Slack each need their own service account or OAuth consent on the far side. A Security Administrator connects apps; Security Reader is enough for the person who reviews alerts weekly.

1. License the right path from the table and assign the licenses, or confirm the E5 service plan is enabled.
2. Connect the Microsoft 365 app connector; then turn on the Defender for Endpoint integration for discovery, or deploy a log collector for the firewall where Defender for Endpoint is not on the devices.
3. Turn on the five policies above in alert-only mode and route alerts to a shared mailbox or a Teams channel.
4. Review for two weeks; then enable the governance actions (unsanction, remove external users, disable app) and the session policy.
5. Monthly: review the discovered-apps report, the OAuth app inventory and the alert closure rate with whoever owns security.

The Cloud App Security Information and Threat Protection service does steps 2 through 4 as a fixed-price project at $4,950, quoted in writing before work begins; the Microsoft licenses are your own subscription at list price. Tenants that also want Defender for Identity should read the Defender for Identity licensing article first, since that product changes which path on the table is cheaper.

What is cloud app security in Microsoft 365?

Cloud App Security was the former name of Microsoft Defender for Cloud Apps, Microsoft's cloud access security broker. It discovers which cloud apps people use, connects to SaaS platforms through APIs to apply file and activity policies, governs OAuth apps, and can control browser sessions through Entra ID Conditional Access. The product was renamed in November 2021 and lives in the Microsoft Defender portal.

How much does Defender for Cloud Apps cost?

On the October 2026 price list the standalone license is $3.50 per user per month on an annual commitment ($42.00 per year) or $4.20 month to month; the frontline F1 variant is $2.40. It is included in Microsoft 365 E5 ($60.00), Enterprise Mobility + Security E5 ($18.00) and the Microsoft Defender Suite ($12.00, for E3 tenants).

Is Defender for Cloud Apps included in Microsoft 365 E5?

Yes. Microsoft 365 E5 and Enterprise Mobility + Security E5 both include it, as does the Microsoft Defender Suite (the former Microsoft 365 E5 Security). Microsoft 365 E3 and Business Premium do not.

Does Microsoft 365 Business Premium include Defender for Cloud Apps?

No. Business Premium includes Defender for Business and Defender for Office 365 Plan 1. Add the $3.50 standalone license, which works fully because Business Premium already has Entra ID P1, or add the Microsoft Defender Suite for Business Premium, which we quote on request.

What are connected apps in cloud app security?

Connected apps are the API connectors between Defender for Cloud Apps and a SaaS platform: Microsoft 365, Google Workspace, Salesforce, Box, ServiceNow and others. A connected app sends its activity and file metadata to Defender for Cloud Apps so that file policies, activity policies and posture assessments can run on it. Microsoft 365 should be connected on day one.

Where is the cloud app security portal now?

In the Microsoft Defender portal at security.microsoft.com, under Cloud apps. Policies, the cloud app catalog, app governance and the app connectors are all there, and alerts appear in the shared incident queue with the other Defender products.

Do I need Entra ID P1 for Defender for Cloud Apps?

Only for session controls (Conditional Access App Control), which route a sign-in through Defender for Cloud Apps using an Entra ID Conditional Access policy. Discovery, app connectors, file policies and app governance work without P1. Business Premium, E3 and E5 include P1; Office 365 and Business Standard tenants would add it at $7.00.

• Commercial price list, October 2026: Microsoft Defender for Cloud Apps and F1, Microsoft Defender Suite, Microsoft Defender Suite Add-on FLW, Enterprise Mobility + Security E5, Microsoft 365 E3, E5 and Business Premium, Defender for Identity, the Defender for Endpoint P2, Defender for Office 365 P2 and Entra P2 add-ons for E3, Microsoft Entra ID P1
• Microsoft Defender for Cloud Apps — Microsoft, checked 2026-10-11 (app catalog size, risk factors, the Defender Suite at $12.00)
• Microsoft To Include App Governance in Defender for Cloud Apps Subscriptions — Redmond Magazine, checked 2026-10-11 (the 1 June 2023 licensing change)
• Microsoft Defender and Purview Suites for M365 Business Premium — CIAOPS, checked 2026-10-11 (the 1 October 2025 rename and the Business Premium add-on contents and 300-user limit)
• What license is required for Microsoft Defender for Cloud Apps — debug.to, checked 2026-10-11 (inclusion in Microsoft 365 E5, E5 Security and EMS E5)