Deploy and Manage Microsoft Defender for Cloud Apps in Microsoft 365

Microsoft Defender for Cloud Apps helps organizations discover Shadow IT, monitor SaaS activity, protect sensitive data, control risky sessions, and respond to cloud threats across Microsoft 365 and connected applications. This guide covers the licensing, the seven deployment steps, the policy tuning that keeps the alert queue useful, and the response workflow.

What Microsoft Defender for Cloud Apps does

Microsoft Defender for Cloud Apps is Microsoft's cloud access security broker (CASB) capability for Microsoft 365 and other SaaS applications. It gives security teams visibility into cloud app usage, user activity, data movement, risky OAuth apps, and suspicious behavior that traditional firewalls and endpoint tools may not fully see on their own. It complements, rather than replaces, controls such as Microsoft Defender for Endpoint, Microsoft Entra ID Conditional Access, Microsoft Purview DLP, secure web gateways, firewalls, and SIEM/SOAR platforms.

How Defender for Cloud Apps fits into Microsoft 365 security

A current deployment uses Defender for Cloud Apps together with Microsoft Defender XDR, Microsoft Defender for Endpoint, Microsoft Entra ID, Microsoft Purview, and, where needed, Microsoft Sentinel. Defender for Endpoint can feed discovered cloud app usage from managed devices. Microsoft Entra ID Conditional Access can route selected sessions through Conditional Access App Control for real-time monitoring and enforcement. Microsoft Purview provides sensitivity labels and DLP policies for information protection. Microsoft Defender XDR correlates Defender for Cloud Apps alerts with endpoint, identity, email, and collaboration signals, while Microsoft Sentinel covers SIEM use cases, hunting, and long-term log correlation across non-Microsoft sources.

Licensing: which plan includes it

Defender for Cloud Apps is sold on its own at $3.50 per user per month on an annual commitment, $42.00 per year, and is part of Microsoft 365 E5 ($60.00 per user per month), Enterprise Mobility + Security E5 ($18.00) and the Microsoft Defender Suite ($12.00). Those are Microsoft list prices from the October 2026 price list; the standalone subscription is on our Microsoft Defender for Cloud Apps page at the same price.

Microsoft 365 Business Premium does not include it. Business Premium tenants, which Microsoft limits to 300 users, add the Microsoft Defender Suite for Business Premium, which Microsoft documents as adding Defender for Cloud Apps together with Microsoft Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2 and Defender for Office 365 Plan 2; it is $10.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list), sold through our Business Premium security add-on page.

Related capabilities carry their own licenses. Conditional Access App Control runs through Microsoft Entra ID Conditional Access, which needs Entra ID P1 on the user; Business Premium, Microsoft 365 E3 and E5 and EMS E3 already include P1. Endpoint-based Cloud Discovery and blocking need Microsoft Defender for Endpoint on the device. The information protection and DLP features you intend to use need the matching Microsoft Purview licensing. If you buy through a Cloud Solution Provider, check the New Commerce Experience term, commitment and cancellation rules before deployment so the technical design matches the licensing model; our EMS E3 vs E5 guide covers the suite paths.

Step 1: enable Defender for Cloud Apps and connect your environment

Administration is centered in the Microsoft Defender portal at security.microsoft.com, with related configuration in the Microsoft Entra admin center and Microsoft Purview portal. Start by confirming licensing, assigning the right admin roles, and enabling Defender for Cloud Apps. Then connect Microsoft 365 workloads and any supported SaaS applications that need monitoring, such as collaboration, CRM, file storage, or service management platforms. App connectors use APIs to provide visibility into user activities, files, sharing, permissions, and security events depending on the connected application and available permissions.

Step 2: discover Shadow IT and assess cloud app risk

Cloud Discovery helps you understand which cloud applications employees are using, how much data is being uploaded or downloaded, and which apps may create compliance or security concerns. Discovery data can come from Microsoft Defender for Endpoint on managed devices, network logs collected from firewalls and proxies, or log collectors where appropriate. Defender for Cloud Apps compares discovered applications against Microsoft's cloud app catalog and risk attributes, such as security controls, compliance attestations, data handling, authentication support, and business characteristics. Use this data to define sanctioned, tolerated, and unsanctioned apps instead of assuming that every unsanctioned app user is malicious.

Step 3: sanction, unsanction, and govern cloud applications

After reviewing discovered apps, tag approved applications as sanctioned and risky or prohibited applications as unsanctioned. Where supported, unsanctioned app access can be blocked using Microsoft Defender for Endpoint, network security controls, or other enforcement points. The goal is not only to block risky tools, but also to provide approved alternatives. Document why an app is allowed or blocked, define exceptions, and periodically review app usage because business needs and SaaS risk profiles change over time.

Step 4: protect sensitive data with Microsoft Purview and Defender for Cloud Apps

Information protection should be based on Microsoft Purview sensitivity labels, Microsoft Purview DLP, and clear data handling policies. Defender for Cloud Apps can help identify sensitive files in connected SaaS apps, detect risky sharing, apply governance actions where supported, and enforce session controls for browser access. Common use cases include detecting externally shared sensitive files, removing public links, applying labels, blocking downloads to unmanaged devices, or protecting downloads with a sensitivity label instead of allowing unrestricted copies.

Step 5: use Conditional Access App Control for real-time session protection

Conditional Access App Control is an established Defender for Cloud Apps capability that works with Microsoft Entra ID Conditional Access. For selected users, apps, devices, locations, or risk conditions, Entra ID can route browser sessions through Defender for Cloud Apps for real-time monitoring and control. Session policies can monitor user activity, block downloads, protect downloads, restrict uploads, prevent copy or print actions in supported scenarios, and provide step-up controls for unmanaged devices or risky access conditions. Start with monitoring before blocking so you can tune policies and avoid business disruption.

Step 6: review OAuth apps and consent risk

OAuth app governance is an important part of modern SaaS security. Attackers often abuse consent grants or over-permissioned apps to maintain access to Microsoft 365 data. Defender for Cloud Apps can help identify OAuth apps connected to your tenant, review permissions, detect suspicious app behavior, and support governance actions such as investigating the publisher, revoking app consent, or disabling risky applications. Include app consent review in your regular security operations process, especially for apps requesting broad mailbox, file, or directory permissions. Pair it with the Entra ID user consent setting: Microsoft's recommendation is to allow user consent only for apps from verified publishers and only for permissions you have classified as low impact, with an admin consent workflow for everything else.

Step 7: detect threats and respond through Defender XDR

Defender for Cloud Apps generates alerts for suspicious SaaS activity such as impossible or atypical travel, unusual download volume, activity from risky locations, suspicious inbox or file activity, and anomalous behavior in connected apps. In the current Microsoft security stack, these signals appear in Microsoft Defender XDR incidents alongside endpoint, identity, email, and collaboration evidence. Analysts triage incidents using user context, device health, sign-in history, activity timelines, file activity, and related alerts. Response actions may include requiring reauthentication, revoking sessions, disabling a user, removing external sharing, revoking OAuth consent, or escalating to Microsoft Sentinel for broader investigation.

Tune the policies before you trust the alerts

Defender for Cloud Apps has seven policy types: anomaly detection, activity, app discovery, file, OAuth app, access, and session. The templates get you started; the value comes from tuning them to your tenant. Give executives, administrators, service accounts, and frequent travelers their own thresholds, so that a sales director's third country in a week is not the same alert as a finance clerk's. The alerts worth keeping from day one are sign-ins from anonymous IP addresses, impossible travel, suspicious inbox forwarding rules, unusual download volume, ransomware indicators, activity from unfamiliar locations, and abnormal administrative activity.

Triage each alert with the same five questions: who is the user and what is their role, is the device healthy, what does the sign-in history say, what exactly happened in the activity log, and which related alerts sit in the same Defender XDR incident. Then decide expected, risky, or confirmed malicious, and record the decision so the next analyst does not repeat the work.

Automate the response once the decision rules are stable: Defender XDR automated investigation for the common cases, and Microsoft Sentinel playbooks or Power Automate flows that post to a security channel, open a ticket in ServiceNow or Jira, revoke an OAuth grant, suspend a user, require a password reset, or escalate a high-severity alert to whoever runs incident response. Test every automated action on a pilot group first; a response that is fast but wrong disrupts the business more than the alert did.

Rollout rules that avoid disruption

Begin with a monitoring and discovery phase before enforcing blocks. Define what makes an app sanctioned, tolerated, or prohibited. Pilot policies with high-risk groups such as finance, HR, executives, and users with access to sensitive data. Tune alert thresholds to reduce false positives. Coordinate Defender for Cloud Apps policies with Entra Conditional Access, Defender for Endpoint, Purview DLP, and incident response playbooks. Document exceptions and review them regularly. Pair every technical control with user guidance so employees know which approved tools to use instead of the risky alternatives.

Frequently asked questions

Is Microsoft Cloud App Security the same product as Defender for Cloud Apps?

Yes. Microsoft renamed Microsoft Cloud App Security to Microsoft Defender for Cloud Apps and moved administration into the Microsoft Defender portal at security.microsoft.com. The policies, Cloud Discovery, and Conditional Access App Control carried over; what changed is that alerts now land in Defender XDR incidents next to endpoint, identity, and email evidence.

Which license includes Defender for Cloud Apps?

Microsoft 365 E5, Enterprise Mobility + Security E5, and the Microsoft Defender Suite include it. On its own it is $3.50 per user per month on an annual commitment (Microsoft list price, October 2026 price list). Business Premium does not include it and reaches it through the Defender Suite for Business Premium add-on.

Do I need Defender for Endpoint to use Cloud Discovery?

No. Cloud Discovery can read firewall and proxy logs, uploaded manually or through a log collector. Defender for Endpoint adds discovery from managed devices wherever they are and the ability to block unsanctioned apps on those devices.

Should we block unsanctioned apps immediately?

No. Run discovery for a few weeks, tag apps as sanctioned, tolerated, or unsanctioned with a business owner for each, communicate the approved alternative, then block in a pilot group before the whole tenant. Blocking a tool people depend on without an alternative creates workarounds you will not see.

What should the first session policy be?

Monitor-only for unmanaged devices, then block downloads of files that carry a Confidential or higher sensitivity label from unmanaged devices. It catches the most common leak path, personal laptops and phones in a browser, without touching managed devices at all.

Sources

• Microsoft Entra licensing — Microsoft Learn, document dated 18 June 2026, checked 2026-10-11 through the MicrosoftDocs source on GitHub (which suites include Entra ID P1 and P2)
• What is Conditional Access? — Microsoft Learn, 27 April 2026, checked 2026-10-11
• Configure how users consent to applications — Microsoft Learn, 15 June 2025, checked 2026-10-11
• Add Microsoft Defender Suite for Business Premium to your subscription — Microsoft Learn, 24 September 2025, checked 2026-10-11
• Microsoft US commercial price list, October 2026: Microsoft Defender for Cloud Apps, Microsoft 365 E5, Enterprise Mobility + Security E5, Microsoft Defender Suite

Key takeaways

• Microsoft Cloud App Security is now Microsoft Defender for Cloud Apps and is managed through the Microsoft Defender portal.
• Defender for Cloud Apps provides Shadow IT discovery, SaaS app governance, information protection, threat detection, OAuth app review, and real-time session controls.
• It is included in Microsoft 365 E5, EMS E5 and the Microsoft Defender Suite, sold alone at $3.50 per user per month (October 2026 price list), and reached from Business Premium through the Defender Suite for Business Premium add-on.
• Deployments that work integrate Defender for Cloud Apps with Microsoft Defender XDR, Defender for Endpoint, Microsoft Entra ID Conditional Access, Microsoft Purview, and, where needed, Microsoft Sentinel.
• Start in monitor mode, classify apps by business risk, tune thresholds by user group, pilot enforcement carefully, and automate response only after the triage rules are stable.

IT Partner's Microsoft Defender for Cloud Apps Implementation is $4,500 per project, quoted in writing before work begins: licensing check, app connectors, Cloud Discovery, sanctioned and unsanctioned app tagging, Conditional Access App Control, Purview DLP integration, OAuth app governance, and the Defender XDR alert workflow. The subscription itself is on our Microsoft Defender for Cloud Apps page at Microsoft's list price. Not sure which license path you are on? Book a 30-minute call.