Skip to content

3. Microsoft Defender for Cloud Apps (MDCA)

MDCA (was MCAS)

Title

Ways of working

First decision point - Simple or Complex, i.e. do you need to be concerned about RBAC for instance becuase of the scale of the installation or the number of different parties that may need access to part or some parts of the console?
https://learn.microsoft.com/en-us/defender-cloud-apps/manage-admins

Enable Telemetry

The best practices discussed in the link above include:

  • Discover and assess cloud apps
  • Apply cloud governance policies
  • Limit exposure of shared data and enforce collaboration policies
  • Discover, classify, label, and protect regulated and sensitive data stored in the cloud
  • Enforce DLP and compliance policies for data stored in the cloud
  • Block and protect download of sensitive data to unmanaged or risky devices
  • Secure collaboration with external users by enforcing real-time session controls
  • Detect cloud threats, compromised accounts, malicious insiders, and ransomware
  • Use the audit trail of activities for forensic investigations
  • Secure IaaS services and custom apps

Warning

  • For best protection, we recommend selecting all Office 365 components.
  • The Office 365 files component, requires the Office 365 activities component and Defender for Cloud Apps file monitoring (Settings > Files > Enable file monitoring).
  • Make sure the last checkbox (Office 365 Files) in the image below is "checked" link to more details

Validate and Test

Note

  • It takes up to two hours after you enable the integration for the data to show up in Defender for Cloud Apps.
  • List of supported Firewalls and Proxies
  • Follow link above for Integration steps with ZScaler, iboss, Menlo, etc...

Enable Reporting

Review and Improve as needed

There is a lot more to be covered, but this will do for now, if you have questions please let us know? https://github.com/dcaddick/gsd_public/discussions

Use MDCA to track, monitor and block Generative AI as needed

To enable Defender for Cloud Apps to track Generative AI SaaS apps in your tenant, follow these steps:

Discover Generative AI Apps:

Setup Policies:

  • Configure policies to automatically trigger alerts when new Generative AI apps are used within your organization.
  • Create policy as per Blog article in link above
  • For organizations using Defender for Endpoint integration, apps tagged as “unsanctioned” will be instantly blocked on onboarded devices.

Monitor Usage:

Microsoft Purview Integration:

Remember that Generative AI adoption is growing rapidly, and having effective visibility and control over these apps is crucial for maintaining security without disrupting productivity. By following these steps, you’ll be better equipped to manage Generative AI apps in your tenant! 🚀🔒

For detailed documentation on each step, refer to the following links:

For those who prefer a Video - check Andre's session here - Microsoft Defender for Cloud Apps - Why "CASB" and how it can help monitor and control ChatGPT usage alt text

I'll try and add some screenshots later...

Troubleshooting