L5. Defender for Cloud Apps: Shadow IT and App Governance
Visual workflow edition
Worked example, diagrams and a question with time to think. Synthetic American-English narration; examples are fictional. Reviewed October 2026.
Read the video transcript
Your discovery report shows employees using an unfamiliar file-sharing service. Should you block it immediately? First establish what the report observed, whether the service has a business owner, and which control could actually enforce your decision. This lesson turns a shadow I T finding into a repeatable review.
Cloud discovery uses available traffic signals to identify cloud application usage. Connected applications can provide activity and governance capabilities. App governance focuses on application behavior and permissions in supported environments. These views answer different questions. Seeing a service in discovery does not mean you have a complete record of every action performed inside it.
In our fictional case, a design team uses the service to exchange large files with a supplier. Review usage, the application's risk information, and the data involved. Ask the business owner whether an approved alternative exists. A risk score can guide prioritization, but the actual data sensitivity and workflow determine the impact of a control change.
Marking an application as unsanctioned expresses a governance decision. Blocking depends on the relevant integration and configuration. Confirm the enforcement path instead of assuming a label stops traffic everywhere. Test with an approved account and device, record the observed result, and check whether other access paths remain available. Keep the policy decision and technical outcome separate.
For an application with delegated or application permissions, inspect what access was granted and whether the owner still needs it. Broad permissions deserve context, not an automatic accusation. Coordinate any consent or access change, because it can break a legitimate workflow. Verify the result and keep an accountable owner for future reviews.
An app is tagged unsanctioned, but a test user can still reach it. Does that prove discovery failed? Pause and identify which part of the workflow needs attention.
No. Discovery and enforcement are different capabilities. Review the integration, device and user scope, and the actual blocking configuration. Then repeat an authorized test. The core lesson is to move from observed usage to business context, and from a control decision to verified enforcement. The dashboard label is only one step.
Course outlineLesson 5 of 18
Microsoft Defender for Cloud Apps provides CASB capabilities for discovering shadow IT, controlling app access, and enforcing session policies. This lesson covers the Cloud App Catalog, session controls, app governance, and investigation tools for the SC-200 exam.
What Is Defender for Cloud Apps?
Microsoft Defender for Cloud Apps (MDA, formerly Microsoft Cloud App Security) is a Cloud Access Security Broker (CASB) that provides visibility into cloud app usage, data protection, and threat detection across SaaS applications.
Core capabilities:
- Cloud Discovery: Identify shadow IT by analyzing firewall and proxy logs
- App Connectors: API-based integration with sanctioned apps (Microsoft 365, Salesforce, Box, etc.)
- Conditional Access App Control: Real-time session monitoring and control
- App Governance: Monitor and control OAuth apps registered in your tenant
Cloud Discovery and Shadow IT
Cloud Discovery analyzes traffic logs to identify which cloud applications users are accessing. Discovery methods:
| Method | Data Source |
|---|---|
| Log collector | Firewall/proxy logs uploaded automatically |
| Defender for Endpoint integration | Network signals from onboarded devices |
| Cloud Discovery API | Programmatic log upload |
App Connectors
API connectors provide deep visibility into sanctioned applications:
- Microsoft 365: Full integration (files, activities, accounts)
- Salesforce, Box, Dropbox, Google Workspace: Activity monitoring, file scanning, governance actions
- AWS, Azure, GCP: Cloud platform activity logs
Connectors enable file policy scanning (DLP), activity policies, and anomaly detection within connected apps.
Conditional Access App Control
This feature proxies user sessions through Defender for Cloud Apps to enforce real-time controls:
- Monitor only: Log all activity without blocking
- Block downloads: Prevent file downloads based on conditions (unmanaged device, sensitive label)
- Protect on download: Apply sensitivity labels or encryption on download
- Block upload: Prevent uploading files matching DLP patterns
- Block copy/cut/print: Prevent data exfiltration through clipboard or print
Session policies are created in Defender for Cloud Apps and enforced through Microsoft Entra Conditional Access (the Conditional Access policy routes the session through the proxy). Exam tip: Conditional Access App Control requires a Microsoft Entra Conditional Access policy that routes the session to Defender for Cloud Apps. Both components must be configured.
App Governance
App Governance monitors OAuth applications registered in Microsoft Entra ID:
- Detects overprivileged OAuth apps
- Identifies unused apps with broad permissions
- Monitors app API call patterns for anomalies
- Enables policy-based governance (auto-disable apps matching criteria)
This is critical for detecting OAuth consent phishing attacks where users grant malicious apps access to their data.
Investigation Tools
Key investigation capabilities include:
- Activity log: Searchable log of all user and admin activities across connected apps
- Files page: Inventory of files shared externally or matching DLP policies
- User page: Per-user risk assessment with activity timeline
- IP address ranges: Define corporate IP ranges to distinguish internal from external access
- ✓Defender for Endpoint integration is the recommended method for shadow IT discovery because it covers remote users.
- ✓The Cloud App Catalog scores 31,000+ apps on 90+ risk factors with scores from 1 (highest risk) to 10 (lowest risk).
- ✓Conditional Access App Control requires both a Defender for Cloud Apps session policy and a Microsoft Entra Conditional Access policy.
- ✓App Governance monitors OAuth applications for overprivileged access, anomalous behavior, and consent phishing.
- ✓API connectors provide deep visibility into sanctioned apps including file scanning and activity monitoring.
1. Which method for discovering shadow IT is recommended because it covers remote users not connected to the corporate network?
2. An organization wants to prevent users on unmanaged devices from downloading files from SharePoint Online. Which feature should they configure?
3. A malicious OAuth application is detected requesting broad permissions in your tenant. Which Defender for Cloud Apps feature provides visibility and governance for this threat?
Keep learning
Use the knowledge check above to test your understanding. You can browse every lesson without signing in; opening another lesson does not mark this one complete.
Next lesson: Incident Management: Correlation, Triage and Response →