Microsoft Defender for Cloud Apps Reviews

We were looking for protection for cloud applications, specifically for the SharePoint directory. One of the use cases is to monitor employees who are leaving the organization in the next month. We do this by placing them in a separate Active Directory container and monitoring their activity. 

For example, we would monitor if they download a large number of files from cloud applications, delete something, or engage in other abnormal activities. This is one use case for Microsoft Defender for Cloud Apps.

The solution is user-friendly and provides great visibility into threats. There are easy options available for specific workflow inspections. We can also get support by going through the Microsoft documentation, which is straightforward.

Microsoft Defender for Cloud Apps helps us prioritize threats across our enterprise. It covers us from a compliance perspective and protects our organization's data. Data protection is a very important aspect of any new organization, as we need to protect our data from both external attacks and insider threats. Microsoft Defender for Cloud Apps helps us monitor for abnormal activity by insiders, which is one of the most important access points for attackers today. Additionally, the different cloud apps that Defender for Cloud Apps supports provide us with much more visibility into potential threats and activities on the internet.

We have integrated Microsoft Defender for Cloud Apps alerts with Sentinel. The integration is straightforward. We can find the configuration details on Microsoft's official documentation website. If we are familiar with how Microsoft products work, we will be able to follow the instructions clearly.

Microsoft Defender for Cloud Apps and Sentinel work natively together to deliver coordinated detection and response across our environment.

Our integrated Microsoft solutions provide comprehensive threat protection, covering most of the tactics and techniques relevant to the MITRE ATT&CK framework.

Sentinel allows us to ingest data from our entire ecosystem. When implementing an SIEM solution, there are always prerequisites such as Active Directory logs, security logs, firewall logs, and DNS logs. These are important logs that need to be ingested into the environment. Sentinel has many third-party connectors available that make integrations straightforward. Microsoft provides the configuration details in the Sentinel platform. It is important to integrate all relevant log sources into the SIEM solution so that we can detect and be alerted to any type of threat factor, whether it is from an internal or external source.

Integrating third-party solutions into the platform requires a separate configuration, but Microsoft provides the necessary information. However, we need to have the appropriate permissions to execute these setups.

Sentinel provides a centralized dashboard that covers threat management and configuration. It gives us complete insight into what entities are accessing, as well as full details for investigation. We can see how the alerts and threats are relevant to suspicious activities, whether they are related to malicious IP addresses, suspicious ASHAs, or any other indicators of compromise. All of this relevant data can be seen in a single pane. Recently, Microsoft introduced a new investigation experience in a single pane. This means that we can now get a lot of details in a single pane, without having to go there and execute a query. There are a lot of new insights being developed in the Sentinel platform these days.

It has software intelligence. They recently introduced Microsoft Defender Threat Intelligence, which covers almost all IOCs. This protects organizational assets from threats and suspicious traffic associated with IOCs. If a match is found, alerts are generated. This is a very interesting feature. Another great feature is automation and logic apps. We can create a number of operations, such as posting in a team's channel if a severe incident occurs or sending an email notification. There are many operations available, so we can automate a lot of tasks.

Microsoft Defender for Cloud Apps helps us stay compliant. It has predefined mechanisms in place to prevent attacks. For example, if an external user tries to access our SharePoint folders or files, an attack will be blocked. This is why it is important to give appropriate access to guest users. Microsoft Defender for Cloud Apps has many features and benefits. It provides a number of policies that can be configured to meet the specific needs of our security team. These policies can be used to customize cloud applications so that only authorized users can access them and perform operations that benefit the organization. In terms of safety and security, Microsoft Defender for Cloud Apps is top-notch.

Using the solution's automation features, we can suppress false positive alerts. We can also close alerts, lower their severity from "high" to "low" or "informational," or close them immediately with the appropriate commands. This will depend on the configuration automation rule and the perspective from which we are testing.

Microsoft Defender for Cloud Apps provides a single console. We are also provided with Microsoft templates to enable workbooks instantly. Alternatively, we can build our own customized workbooks to provide better insights and improve our SOC efficiency and overall performance.

Consolidating all of our security data into one dashboard has saved our security operations team a significant amount of time. From an analyst's perspective, it is now much easier to correlate events, investigate alerts, and visualize specific entities. For example, an analyst can quickly see all of the alerts associated with a particular IP address, or they can view all of the activity for a specific entity over the past 24 hours or 7 days. This level of detail and insight would not be possible if our data were siloed in multiple dashboards.

The single dashboard saves our operations approximately 20 hours per week by eliminating the need to access multiple consoles and tabs.

Microsoft Defender for Cloud Apps threat intelligence can help us prepare for potential threats before they happen. However, it depends on how we develop the policies for the database to block or ignore things in our environment.

We have been using Microsoft Defender for Cloud Apps primarily for discovery. We have locked down our consent apps, so users can no longer create apps in our environment without approval. We are looking to retroactively fix a lot of that and build out a governance program going forward.

Defender for Cloud Apps has given us good visibility regarding what we've allowed into our environment until now. It helps us to know our inventory, understand what our customers are using, and steer them toward safer practices.

We primarily use Microsoft Defender for Cloud to secure and provide controlled access to our applications. We have a few hosted applications in the cloud, including some of our critical applications. We need a solid firewall and security setup in the cloud to protect all those applications. Microsoft Defender for Cloud serves this purpose because it provides efficient security for our cloud applications. Its controlled auditing and other filtering setups also offer uninterrupted access to users. 

We use Defender for Identity and Defender for Cloud. Integrating the two is entirely straightforward. Once we deploy Azure or any other Microsoft services, the integration between each product is released. You can integrate Defender for Cloud and identity management with a click. Both are security features that have to work. If we get a similar log issue from Defender for Cloud, this log is automatically passed to Identity to check if there is any mismatch or identity-based concerns. It'll correlate the logs and easily identify the issues.

These solutions work together natively, each addressing a different security dimension. We prefer this identity-based solution focusing on user identity security, whereas Microsoft Defender for Cloud App concentrates on applications. Application security is the priority in this. Application security also requires identity management because users will be accessing applications based on identity rules. If the identity policies are met, it will easily access these applications hosted in the Cloud. Microsoft Defender Cloud has separate policies to maintain specific access for users based on their privileges, so it is all correlated.

It should work in correlation because we are not using a third-party product for all this security. We expect a solid correlation because everything is the legacy software of Microsoft. We are using multiple Microsoft products with Azure, including OneNote, OneCloud, etc., and every product requires security in each layer. We have numerous layers of protection in Microsoft. Each layer must be correctly oriented and governed by a set of policies so that each level satisfies the user policies and each policy forwards to the next level. So in that way, Microsoft has a different level of setups, and this Microsoft Defender for Cloud is one that last setup.

Our cloud strategy will change as we move more applications to the cloud, and all require security. As we migrate more into the cloud, our security becomes more complex. Once we have applications deployed in the cloud, it is better to have a single vendor for all the security solutions because Microsoft has a solution for each aspect of the application setup. Microsoft provides enough security features that we don't require any third-party applications. Each layer has to complement another layer. Because it is a one-vendor Microsoft solution, it's easy for us to identify and troubleshoot issues. I prefer a single solution rather than a multi-vendor solution.

Defender for Cloud Apps is an efficient option for protecting applications you use when working. They can be controlled to avoid risks or loss of information because most of our activities are pretty confidential. We don't want to share this application with many people. Since it is in the cloud, we have less control over that. After deployment, Microsoft Defender for Cloud Application maintains a stable, secure, and efficient security process in the cloud. 

It has different tools to guarantee this security, including various policies, classic control mechanisms, algorithms, and a threat database. It completely solves our security concerns about our cloud applications.

Defender helps automate security tasks. Traditionally, we would require a SIEM tool or costly antivirus software to implement this solution in the cloud. We would need a SIEM solution to analyze data. Most premium antivirus features and threat database features are included in this solution. 

Defender's dashboard has simplified our operations somewhat, but we still require different dashboards for each security setup because we continue to use traditional antivirus software for our on-premise environment. We will have multiple tabs related to security. Each layer of protection has different accounts, and you can browse the options. We need to browse the options and check everything. 

Microsoft Defender has a fantastic dashboard because every option is available in the dashboard. Most of the alerts are found in the dashboard. We just need to click on that to see their issues. Their highly rated issues can be easily checked from the dashboard. Most of the essential features are covered in the dashboard.

The solution helps us be proactive about threats because it features an updated database of the current threats that are most significant in the industry. Some of the cybersecurity threats have been mitigated by most of the antiviruses. Defender's AI-based mechanism can handle novel threats and malware, whereas many antiviruses use application signatures. 

It has saved us some time spent on configuration. Configuring on-premise and cloud applications separately is time-consuming, but Microsoft Defender for Cloud reflects configuration changes in the cloud to the on-premise applications. Everything mainly works as a single network, so it cuts the time spent on the configuration in half. Financially, it has cut our costs by about 20 percent.

It has also considerably reduced our time to detect and respond to threats. Some antivirus solutions won't catch a threat until it has reached more than half of our network. Still, Microsoft can detect a threat once it comes to the perimeter area with advanced artificial intelligence technology. Defender has reduced our detection and response time by about 60 percent. 

For Microsoft Defender for Cloud Apps, I used it in cloud applications. It helped me identify if someone was attempting to access applications without the correct credentials. It provided me with information on where access attempts were made and what type of information was being sought.

The most valuable features of Microsoft Defender for Cloud Apps include live, up-to-date information, which provided real-time alerts, and the ability to delve into detailed metadata information. This capability was particularly useful for me in determining unauthorized access attempts. The anomaly detection features were also beneficial, as they learned how the system operated and provided useful information. However, further investigation was sometimes necessary for me to determine if alerts were false positives.

We use Defender for governance, discovery, and application awareness. It's also useful for detecting shadow IT and anomalous user behavior. 

Defender helps us control which applications are being used and gain more security insight into remote and hybrid users based on user identity and login location. You can also integrate Defender for Cloud Apps with Defender for Endpoint to extend its capabilities.  

Defender saves us time. I can't quantify that because I never track it, but it has helped me quickly discover issues and get a sense of the users' applications, locations, etc. Defender saves money because I've eliminated some tools and tasks that I previously completed manually. I can do some tasks in one hour that used to take me three. 

MCAS was onboarded for the purpose of detecting shadow IT. As the organization moved towards more SaaS solutions, we wanted to make sure that there is a way to monitor and govern the IT services coming up as shadow IT. We are a very big organization where a lot of services get onboarded, and some of the things may go unnoticed. We wanted to detect the shadow IT software being installed or shadow IT happening within a department or business unit.

We also wanted to make sure that the cloud access security broker provides a DLP kind of solution for Office 365. For example, if I am uploading a document with PI data, MCAS should scan and make sure that the right classification is applied. When the right classification is applied, the document gets encrypted, and relevant information protection is applied. If the right classification is not applied, the users are alerted to make sure that they go and remediate the document, task, file, etc.

This is how we started with this solution the last year. Going forward, as a strategic solution, we are also looking at using MCAS to govern the Office environment. We have started onboarding solutions like Microsoft Teams, SharePoint Online, OneDrive, and Exchange Online. 

Our setup is a mixture of on-premises and cloud solutions. At this point in time, the major cloud providers are AWS and Azure, and we also have on-premises products such as Symantec DLP, Doc Scan, etc.

There are certain regulatory requirements in our bank for personal data and confidential information that need to be monitored from a security standpoint. It is a regulatory and standard requirement to have such a solution in place. 

MCAS is a dedicated solution for Office 365 and other productivity-related solutions, and it really helps to automate some of the processes. It would have been difficult for us to find a similar product. It gels well with some of the solutions or technologies that we have, especially with Microsoft Azure and Office 365.

From a security monitoring perspective, there is a productivity improvement and fewer human errors.

In terms of user experience, if users mistakenly put PI information or some kind of data, it can detect and alert them. From that aspect, it is doing the job, but we are using it from a security standpoint. I'm more from a regulatory environment, and there are security requirements that are enforced by regulators. So, we cannot provide some of the end-user experience features, and there should always be a balance between the end-user experience and the security standpoint. MCAS is more of a backend security posture product. I won't position it as enhancing the user experience.

My use of CloudApp in this scenario is to manage the usage of secure cloud applications. I assist the customer in deciding and integrating only secure cloud apps into their environment, using Defender for Cloud Apps discovery and alerting scenarios to identify which cloud apps should not be available. 

I particularly alert for new applications, implementing those alerting routes so that the customer is aware when new apps are added to the Cloud Discovery catalog, especially those using legacy authentication protocols.

The discovery function and the discovery catalog are really valuable. The ability to sanction unsanctioned apps using Secure Score benchmarking, included in Cloud, is also beneficial. These features enhance the organization by helping to manage and control cloud app usage effectively.