Microsoft Defender for Cloud Apps Reviews

We use Microsoft Defender for Cloud Apps for discovery, data exfiltration, and sensitive data exposure.

Some organizations with E5 or E3 licenses enable Microsoft Defender for Cloud Apps for their users, often with default settings. These organizations typically use OneDrive and SharePoint. With Defender for Cloud Apps, especially when integrated with Defender for Endpoint, they want to monitor which SaaS applications their users are accessing. The primary goal is to discover and track the types of SaaS apps their users use.

Microsoft makes setting up discovery and visibility into cloud app usage easy. I also appreciate its full integration with other Defender and XDR products, such as Defender for Identity, Defender for Office 365, and Defender for Endpoint. You can ingest data from all these endpoints. I especially like the feature that allows you to discover which SaaS applications users access.

Microsoft has been high on implementing Copilot. If it is already integrated for using Copilot for security, that would be great.

I have been using Microsoft Defender for Cloud Apps for three years.

It's pretty stable.

 It has been reliable. I haven't seen it fail. There can be some confusing configuration issues sometimes, but it's quite dependable overall.

It is used by small, large, and government entities.

Improved communication and follow-up would be helpful. Sometimes, we don’t hear back after creating a ticket for a day or two. Even when an engineer is assigned, responding can still take a while despite providing all the necessary logs and information upfront.

Neutral

The deployment process is quick, taking two to three days. The implementation and customization require more time. We need to adjust the setup to fit the client's needs, which involves fine-tuning notifications and alerts to avoid overwhelming them.

First, you need the appropriate licensing. Once you have that, go to security.microsoft.com and integrate with Defender for Endpoints to receive information. While you can ingest logs from different firewalls, such as Palo Alto or Cisco, we usually implement them with Defender for Endpoints. Once a laptop or desktop is set up in Defender for Endpoints, integrating Cloud Apps with the endpoints allows us to collect the data easily.

I rate the initial setup a nine out of ten, where one is difficult and ten is easy.

Taking a proactive approach to keeping your environment secure and informed is key. Microsoft Defender for Cloud Apps helps you monitor what applications your users use and ensures they aren't using any sanctioned by your organization. This proactive control is a significant return on investment.

It's relatively low-cost, especially since it's often bundled with Microsoft 365.

It is also tied to data management. Since it's integrated, it can notify us of potential data exfiltration, like when large amounts of data are leaving the system or the Microsoft Cloud. This feature helps protect intellectual property and sensitive information subject to regulations and compliance standards, such as SOX or NIST. It plays a key role in ensuring data compliance and security.

It's fully integrated with other Microsoft security features. You can even connect it to Microsoft Sentinel, their SIEM product. The integration makes everything work better together, with less deployment effort and a single portal for managing your applications, eliminating the need to switch between different platforms.

Overall, I rate the solution a nine-point out of ten.

We primarily use Defender for Cloud Apps to authenticate users of our cloud applications. Defender validates the identity and allows the user to access the application. 

Defender helps us automate routine tasks. We can use templates to deploy various security solutions. It also consolidates our dashboards, so we can view everything from one console. 

Defender saves us time when responding to critical incidents. Typically, it takes about two or three days to find the root cause, but we can do this in four or five hours with Microsoft security solutions. Our detection time remains unchanged, but the response time is much faster. 

Defender's integration with our Identity solutions is critical in our current setup. It also integrates with Microsoft Sentinel to provide threat visibility. However, there's a delay of about 10 to 15 minutes from when Sentinel detects an incident, and it appears in Defender. We're trying to fix that. 

Defender allows us to prioritize threats across our enterprise, which is crucial. It's easy to integrate Defender with other Microsoft solutions. For example, we use Defender with Sentinel and set conditional access policies in Azure Active Directory. We're currently participating in Microsoft training to learn how to utilize these solutions better.

Defender could integrate better with multi-cloud and hybrid environments. It requires some additional configuration to ingest data from non-Azure environments and integrate it with Sentinel.

We have used Defender for Cloud Apps for a year.

Defender is stable.

Defender is scalable.

I rate Microsoft support eight out of 10. 

Positive

Defender is a cloud-based solution, but our deployment was complex because we have a massive environment. It took us about a month to fully deploy it, including testing and evaluation. I had a five-person team, including engineers, administrators, and management. There is no maintenance after deployment because it runs on Azure infrastructure.

We haven't saved money, but we save time because the integration with Microsoft products is seamless. 

Defender is costly. Still, we get a lot of features, and it's easier to integrate with our other solutions, so it's worth what we pay for it.

I rate Microsoft Defender for Cloud Apps nine out of 10. As a security architect, I would generally recommend a multi-vendor solution with a zero-trust model. However, if you are mostly using Microsoft products, it might make sense to use the Microsoft security suite because of the native integration.

We utilize Microsoft Defender for Cloud Apps in conjunction with Defender for Endpoint. This enables the Cloud App to effectively block unauthorized websites for users. Additionally, it allows us to prevent users from accessing malicious sites, and we can restrict user access based on their device compliance status.

Microsoft Defender for Cloud Apps offers visibility into the usage of enterprise applications and the connections established from both authorized and unauthorized locations and devices.

Microsoft Defender for Cloud Apps, in conjunction with Defender for Endpoint, helps prioritize threats throughout our enterprise by reviewing them, identifying devices with vulnerabilities, and providing us with criticality assessments and recommendations on resolving the issues.

We utilize the complete Microsoft Defender suite, which includes Defender for Endpoint as well as Defender 365. The integration is seamless; we only need to onboard Defender for Endpoint, and it functions exceptionally well.

The integrated solutions work natively together to provide coordinated detection and response across our environment. If Defender detects a malicious email, it will notify me of the detection, block the email, and apply the same actions to all the emails that match the same criteria.

I appreciate the comprehensiveness of the threat protection offered by Microsoft security products due to their functionality and ability to integrate, which other products may not offer.

Microsoft Defender for Cloud Apps has helped improve our visibility and response time.

It helps automate the discovery of high-value alerts. The solution can identify malicious threats and subsequently block the threats while disabling the compromised account automatically.

Microsoft Defender for Cloud Apps has helped us save time through the visibility it provides.

Microsoft Defender for Cloud Apps has significantly reduced our time to detect and respond by several hours through its integration with the rest of the Microsoft Defender suite, thereby reducing our troubleshooting time.

The most valuable feature is its policy implementation. Even public websites are directed to the Microsoft Net proxy, where we can establish policies to determine whether to block, authorize, or manage devices.

Currently, we are only able to utilize the policies for blocking threats. I would prefer to have filtering options incorporated within the policies, enabling the solution to perform tasks beyond mere blocking or allowing.

I have been using Microsoft Defender for Cloud Apps for one year.

Microsoft Defender for Cloud Apps has been stable thus far.

Microsoft Defender for Cloud Apps is scalable. We are not limited by Microsoft in terms of the number of users or devices.

The initial setup is not straightforward due to the numerous meetings beforehand, and the Microsoft documentation can be overwhelming. However, once we familiarized ourselves with the interface, it started making more sense. 

The deployment process took over three months. Initially, we tested the solution to become familiar with it before deploying it to a small number of users. Once we were confident that everything was working correctly, we proceeded to deploy it to all users. Two system engineers were required for the deployment.

The implementation was completed in-house.

We have seen a return on investment with Microsoft Defender for Cloud Apps.

We utilize the Microsoft E5 licensing, which encompasses the entire Microsoft suite; however, it is costly. Furthermore, there are supplementary expenses associated with add-on modules.

I rate Microsoft Defender for Cloud Apps an eight out of ten.

Microsoft Defender for Cloud Apps promptly generates an alert upon detecting a threat. However, I do not believe it has the capability to proactively defend against potential threats.

It is deployed in one environment with 50-plus users.

No maintenance is required from our end.

I recommend that anyone evaluating Microsoft Defender for Cloud Apps should read through all of the documentation first.

We use the product mainly to manage the accounts for Single-Sign-On purposes.

Microsoft Entra ID has improved privilege access management for our organization. We can manage who has access to which account.

The product helps us with privileged identity management to control who has access to what and for how long.

There could be more granular roles that are out of the box included in the product. I guess it would help people who aren't as savvy. Right now, I have to create many custom models for different use cases. It would be great if roles were more geared towards specific use cases to cover multiple aspects. In a case where a role is for a security admin, it could grant roles that are needed and not too many unnecessary roles. For example, it gives the security admin some access to the compliance portal, but the executive may not need that access. So it could be more granular.

We have been using Microsoft Entra ID for three to four years.

The product's stability is pretty good. We never really encountered outages. They are very rare.

We have approximately 1000 Microsoft Entra ID users in our organization. The product has great scalability. That's why we moved to the cloud. We need more roles. It will help us a lot as it grows. Microsoft is already adding more roles within the PIM environment, but the more they add, the more users will go to the cloud.

Microsoft's support services are good. They responded quickly whenever I had questions and sent emails or reached out for anything.

Neutral

We have used Azure AD groups initially. Then, we continued grouping within the security groups and only had a designated cloud once we moved to PIM.

The initial setup could have been done better in our organization. That was one of the reasons I was hired. I had to reset and architect the whole process. It was relatively straightforward.

The product is deployed on a hybrid cloud, including Azure, GCP, and AWS clouds. It is used across a few departments, mainly within their IT realm, marketing, and other departments. But for the most part, it's just those two groups currently using it.

I implemented the product myself.

The product's pricing seems fair.

I rate Microsoft Entra ID an eight out of ten.

Set up your environment correctly first. Take your time to figure out how you want to use it, such as PIM and other use cases. Ensure you set it up properly and then create custom roles when needed. Don't overaccess people; that'd be the main advice. It keeps being upgraded by Microsoft. There are constantly new features getting added. If there's some feature you don't see now, it could be there later. We initially wanted a few features that were added later on. Thus, there's always room for growth.

The product provides a single pane of glass for managing user access for the most part. It helps manage the roles better in one area. It becomes easier to use that way. I don't know if we necessarily use verified IDs. But we typically use HRID just to enforce MFA and other processes.

Initially, the product saved a lot of time because we could create dynamic roles for people with the right access. However, as we move more to the cloud, creating more custom roles saves less time. It still has pros in terms of granular roles.

It easily saves two or three daily tasks per person or user we're onboarding. Let's say it's a good amount of time, especially with the dynamic groups. Each PIM role gets activated as well. I would say it saves 20 to 30 minutes per user account activation.

We have several use cases including file monitoring, unusual travel activities, user investigation, and activity. It pretty much covers every activity based on the cloud.

It helps prioritize insider threats. You can take the necessary actions once you get the logs. And when it comes to malware, if a file is uploaded that potentially has malware, the solution is also very useful. It gives you an alarm on the basis of the hash value of that file.

It is very useful for investigating file exfiltration threats. When it comes to data that is stored in the cloud, you really need to know what is stored there—the contents. You can create many protocols or rules in the tool to know the contents and who the owner is of a file. If we are investigating a threat or alert, it has a really good scope. You get really good details from it.

Overall, the solution has saved us time. For malware, it has an automated investigation feature integrated with Microsoft Defender for Endpoint. If there is suspicious behavior or a malicious file in your computer, it will give you a complete timeline showing how it behaved, how it was executed, and how the file has interacted with the other entities on your machine. You don't need to hunt for the logs. You can just look at the storyline of execution and that saves a lot of time.

It provides real-time detection, most of the time, for malware and other threats. Sometimes, the automated investigation takes some time, although not too long. It provides a smooth flow of investigation, giving you precise data. It saves time compared to manual investigation and the precision is good. On average, it will save one or two hours compared to a manual investigation, depending on the experience and proficiency of the analyst who would do the manual investigation.

In Microsoft Defender for Cloud Apps, there is an option to enable files. Once you enable that, it will give you all the files in your organization and where they are located in the cloud. If you are investigating a data breach and you want to get ahead of the investigation, the first thing you can do is a filename search: Where was it located? What was the file movement? What activity happened with the file? You get all the logs. That feature is very useful for investigation purposes.

It also shows user activity. If we are investigating a user for possible data breaches, we can enter the user's name and see the activities that the user has done. Based on that, you can take the necessary action. It gives you all the logs for that particular user. That feature is also very interesting and useful.

I use more than one Microsoft security product, including Defender for Endpoint as well as the Microsoft compliance portal, which is called Microsoft Purview now. It is integrated with Microsoft Data Loss Prevention. I also use Microsoft Defender for Identity. It is used to see if there is any suspicious traffic coming through your domain controller. In total, I use four Microsoft tools and all of these products are integrated. Internal integration of Microsoft products is quite simple. You just need to create one instance and that's it.

They are like the same product. Whatever information you'll get from one tool is the same information you are going to get from another tool. There will be no inconsistency in the data. They are getting logs from one place, not from different sources, so they are coordinated. If they did not work together, there would be a lot of confusion. If one tool is sent an alert and another sent an alert for the same file, that would be a complete ruckus. It has to be well coordinated.

These solutions are quite comprehensive. Most of the time, they provide alerts in a very detailed manner and it is very easy to investigate. While there is some scope for improvement, it is a very good tool for investigating the security threats we are getting. It's quite comprehensive and really good.

The visibility it provides is quite good. You get all the logs for investigation purposes. But there should be more clarity on what is happening with a file. Sometimes, we'll get false positive alarms. For example, when a SharePoint path has no file sharing, but there is an external user, it will trigger an alarm that the file has been shared with an external user. It happens because an external user has access to it but, in reality, he doesn't access it. But you need to check whether anyone has accessed the file and that takes some time. While giving the alert, if it could be more precise in terms of what happened with that file—why it is giving the alert—it would be more convenient for the investigation and save a lot of time.

The alerting mechanism should be more precise when giving you an alert about what activity has been done with the file, whether it was shared or whether it was in a path where an external user had access to it.

Also, Microsoft should provide more automation features. At this time, they are limited.

We have been using Microsoft Defender for Cloud Apps for about one and a half years.

There is no downtime. The tool is always available.

It's scalable. You need to purchase more licenses if you want to deploy more.

Microsoft technical support depends on the individual who responds. Some Microsoft SMEs have the knowledge and some don't, to be very frank. They'll just go according to a template but they don't have really good investigation skills.

Microsoft could offer much more proficiency in terms of support. They need more individuals with the ability to resolve issues. At the moment, I would rate it as average.

Neutral

I did not work with a previous solution for cloud apps. For antivirus, I worked with McAfee.

I didn't deploy it, but in my experience, it takes time to learn how the features work because most things are not covered in the Knowledge Base that Microsoft has provided. They don't mention what these things are and how they work in the background. It takes an appreciable amount of time to understand how these tools work.

Microsoft Defender for Cloud Apps is only deployed through the cloud. You need to integrate your Azure AD with Cloud Apps. Once you have done that, you don't require a separate deployment model.

In terms of Microsoft Defender for Endpoint, you need to onboard it to your devices through a script. To do that, you can use Intune, SCCM, or many other tools. Intune is native to Microsoft, but SCCM is a third-party tool. You can even deploy it manually.

There is some maintenance involved. The onboarding package can have communication issues and sometimes the antivirus services stop due to malfunction. There are many things that require maintenance. The number of people needed to handle the maintenance depends on the volume of devices you are maintaining.

The E5 license offers everything bundled. People are moving to Microsoft because you buy one license and it gives you everything. That's the reason many companies are attracted to these tools. That is much more beneficial than buying all the suites separately. It's quite economical.

If you are keen on keeping your enterprise safe from external users, so that your files are confidential and external users don't have access to them, you can create a rule in Microsoft Defender for Cloud Apps. If it detects an external user has been added to that file or is collaborating on it, an automated governance action can remove that access in near real-time. We are not using the automation feature at the moment because it can create unwanted results. The scope of the exclusion is very limited in the policy.

In terms of a single dashboard, you need a SIEM tool like Microsoft Sentinel to integrate everything into a single dashboard. But at the moment, without that suite, we need to look at our four tools separately.

Potential threats are mainly detected in terms of hash values, malicious IP addresses, and malicious domain names. If you are looking to protect your environment, you can enter these details into Microsoft Defender for Endpoint. Microsoft Defender for Endpoint enables you to add indicators of compromise and it will protect against those entities.

Regarding going with a best-of-breed strategy rather than a single vendor security suite, both have pros and cons. It's not a black-and-white area. If you are going with one vendor, it will collect the logs in a single way. Everyone who looks at them will say, "This is the issue." It won't give you a different point of view. But if you are using another security product, it will have another methodology to collect and integrate the logs and present the information to you. One security tool can miss something that another security tool will catch. Having more than one will give you diversity in terms of alerts and analysis. But on the negative side, when you have more than one solution, you need to purchase separate licenses and spend some more money.

It depends on the budget of your organization for the security team. If you have a big budget, of course, you can diversify. You will benefit more from having different tools as they will, obviously, decrease the chances of getting hit by malware. But it will cost you more. If you have a limited budget, then you should go with a single tool. If you take the financial considerations out of the discussion, Microsoft pretty much covers everything and you should go for a single solution.

Overall, Microsoft Defender for Cloud Apps is very convenient for investigation, in terms of security breaches, or if there is file exfiltration. It's a handy tool.

We use it in our company for threat detection. My company is into manufacturing, and our IT support is within premises. We don't do client services.

It is a SaaS solution. It is not supported on-premises. The deployment that we have is purely cloud-based.

Cloud App Security is an ever-evolving technology. It is based on artificial intelligence. It uses some data sets that capture all the tools within Office 365 package. It collects all the data majorly in the Office 365 space, and it understands the usage. Across the globe, there might be millions of Microsoft users, and it tries to capture all the data cumulatively and see any anomalies. That is how Microsoft gives you the data. They study different types of organizations in terms of how they behave, what kind of security loopholes can be found in them, and then they give you recommendations. You just implement these recommendations to secure the environment. So, what you get is a tailor-made solution where you can find all recommendations because it is based on artificial intelligence. They give you a tailor-made recommendation to improve your environment. They might recommend multifactor authentication, role-based access, etc. They provide you the classical representation on which users we can target and safeguard more.  All these things are very useful. That's how this tool is helping Microsoft customers, and this is how we have also been using it.

My company relies upon this technology. For us, it is very critical to know any attack beforehand and be prepared for it. In our environment, there are many endpoints, and many devices interact. We have an email system, a storage system, and other systems. The beauty of Cloud App Security is that it can learn data from different applications. For example, Adobe is an application that I'm integrating with Office 365. So, I can expand my horizon of search to that tool and see how that interacts with us. I will get more real-time data, and I will know more use cases about it.

Threat detection is its key feature, and that's why we use this tool. It gives an alert if a PC is attacked or there is any kind of anomaly, such as there is a spike in sending emails or we see an unauthorized website being accessed. So, it keeps us on our toes. We get to know that there is something wrong, and we can isolate the user and find any issues with it. So, threat detection is very robust in this tool.

We can integrate any SaaS-based application with it. It can scan your network and physical devices and the software that you're using. It tries to fetch cumulative data when there are any authentication-related attacks or any network-related attacks and gives us some kind of intimation. We get real-time graphical data, and then we need to do our work to solve the problems.

The product is great. The major benefit is that it is a Microsoft tool. So, if you're in a Microsoft ecosystem, this is the best tool that you can get in the market. In terms of experience, it is unlike any other tool. It is good enough to do all the jobs that other tools are doing. So, you don't need any other tool if you are using it in a Microsoft ecosystem. 

The response time could be better. It will be helpful if the alerts are even more proactive and we can see more data. Currently, the data is a little bit weak. It is not complete. I can't just see it and completely know which user or which device it is. It takes some effort and time on my part to investigate and isolate a user. It would be great if it is more user-friendly or easy for people to understand.

If it is an Office 365 product, I expect it to be in the admin center. That way I would know that this is a part of Office 365. It feels like there is a mismatch, or they are trying to separate the product or do something like that. They should have streamlined the product.

It is not always accurate. Sometimes, there could be some hiccups, and you see false positives, but security is not always reliable, and you cannot depend on one tool to give you all accurate results. It gives me a report that I can see, and if needed, I can act proactively on something. If it is a false positive, it is fine. If it is not, we know that we have done something about it.

We implemented it probably in 2019.

It is a new thing for Microsoft, and it still has a lot of room to improve.

It is completely scalable out-of-the-box. It is completely in interaction with Office 365 services. It can go up to as many users as you have. So, if you have 100,000 users, it is capable of supporting them. I have some 50,000 users, and I'm happy that it is capable of doing that. We have implemented it 100%, and we are happy with what we have got.

It is good for an enterprise company. It is not for a small-scale business. 

We don't require support frequently. I would rate them a seven out of 10. If you have a critical situation, you cannot expect them to give you a call immediately. My experience has not been so great with their paid support in terms of time. Sometimes, they don't even call you back, but when you do get support from them, they are excellent. So, you can't rely on them, and their response time can be improved, but their documentation is good enough. We can read the documentation and help ourselves.

Before this, my company had some tools, but I'm not sure about them. They probably heavily relied upon Splunk and other APM tools. They have had this tool from the time I have been here. Personally, I haven't worked on technologies outside of Microsoft.

It is very easy if you know what you're doing. You just click on the Next button multiple times, and it is complete. It is well-documented in the sense that we know what we can expect from the tool. The documentation is great, and the support is also excellent. So, my experience was very smooth, and it was done in a day.

It does not work on every license. You have to be an Enterprise customer, and you have to have a specific license to have the full benefits of it. So, you require the correct license, and you also need a certain amount of time for it to propagate. It is not immediate. Based on what we were told by Microsoft a few years ago, it takes 24 to 48 hours. They might have improved upon that. It tries to capture the complete environment details, and then it gives you a cumulative experience.

We work around the clock. We have six admins at different time zones who work with this solution.

Its pricing is on the higher side. Its price is definitely very high for a small-scale company.

As an enterprise client, we do get benefits from Microsoft. We get a discounted price because of the number of users we have in our company. We have a premier package, and with that, we do get a lot of discounts. There are no additional costs. It only comes in the top-tier packages. Generally, the top-tier license is the best license that you can get for your organization. If you want, you can buy it separately, but that's not a good idea.

This tool alone is not a great investment, but when you get it as a part of the package from Microsoft, it is good. Along with Microsoft Teams, Office, Exchange, SharePoint, and other solutions, this added feature of an extra layer of security makes a lot of sense. If you are only using this tool, and it is not in a Microsoft ecosystem, then it is not worth it.

For Office 365 environments, there is a great add-on benefit that comes with the Microsoft licensing package. If you have a Microsoft ecosystem, you can get it, and there is no need for any other tool. If you're not in a Microsoft ecosystem, don't bother buying it. It is a good competitor to other products such as Splunk. 

It has not affected our end-user experience in any way. The reason being this is an admin-oriented program, and it does not involve any end user. It just collects data from end-users and gives it to us. After that, it is up to us to act upon it. It does not do anything on its own. It is a threat detection tool, and it doesn't do anything on its own. We have to act to resolve a problem. For example, it will only say, "There is a user who is doing this. Do you want to act upon it? Yes or no?" Based on that, as an admin, we can do certain tasks remotely. The end-user will not know about it. We will see if there is a real threat, and we'll act upon it.

I would rate it a 10 out of 10. It is improving, but it still needs more improvements.

We use Defender for Cloud Apps for shadow IT discovery and managing cloud applications. We use all Microsoft security products, including Defender for Endpoint and Sentinel. Our company has a SOC team that investigates and remediates security incidents in the Sentinel portal.

We only need one dashboard for all Microsoft security products. Sentinel acts as a central system for monitoring and investigating all security data. It's a single feed that covers many solutions.

Defender for Cloud Apps saved us about 20 to 30 percent of our time. We've also saved money. I estimate it's about a 10 percent reduction in costs, but I'm unsure. 

Shadow IT discovery is the feature I like the most. Defender for Cloud Apps provides excellent threat visibility. The solution helps us prioritize threats across our enterprise. We use all Microsoft security products. I had no problems integrating or managing them.

Microsoft's security solutions work together natively to deliver coordinated detection and response. We use Sentinel to ingest security data, which is essential. Sentinel allows us to investigate and respond to threats from one place. I like Sentinel because we can collect logs and data to identify suspicious activity in our environments and establish rules for triggering threat alerts. 

Defender for Cloud Apps is primarily useful for Azure apps. It has limited capabilities for applications based on other cloud platforms. Microsoft security products are excellent in the detection phase, but they should have more features for the response component. 

I would like to see a mobile app for managing Defender for Cloud Apps. We currently use the cloud dashboard, but it would be nice if Microsoft offered more solutions for managing the product. 

I have used Defender for Cloud Apps for one year. 

Defender for Cloud Apps is stable. 

Defender for Cloud Apps is scalable. 

I rate Microsoft's support a ten out of ten. 

Positive

Deploying Defender was a little complex, but it only took a few days. Some of the documentation isn't clear, so I'm a little confused. It doesn't require any maintenance after deployment. 

I do not think Defender for Cloud Apps is expensive.

I rate Defender for Cloud Apps a seven out of ten. It's better to go with a single vendor for all of your security products. When I introduce Defender for Cloud Apps to our customers, most of them have the license, but they do not understand the capabilities. The first thing I do is explain Defender's coverage and functionality, so they understand which features they can apply to their environment. You need to generate a list of requirements first. 

We use it to protect our users' devices against attacks. 

We see stories about attacks in the news, including phishing and spam, Defender helps protect us.

It also gives us an ecosystem. We have one portal where we can manage everything. We don't need to log in to another portal to manage the devices, the antivirus, Defender, or Office. It's a single place to manage everything and that's very good.

It's very easy to install and it includes the Intune portal from Microsoft where I can control all the devices from one place. And because it's a Microsoft product, it integrates with Windows 10 and Windows 11. We don't need to buy anything else.

We have an M365 license and we have an Office admin portal. I manage all the users and licenses through the portal, making it very easy to manage. We have a lot of users coming in and going out of the company, and this makes it simple to provide licenses to people.

I would like to see them include more features in the older licenses. There are some features that are not available, such as preventing or analyzing cloud attacks. We have Defender P2 licenses and Microsoft proposed P3. If it included what was in the old package, such as the M365 license and Office, that would be very good.

I have been using Microsoft Defender for Cloud Apps (MDA) for two years.

The stability is very good. We haven't had downtime. When we receive a message that the service is down, it's only for a few minutes and then all is good. That's true for the whole Microsoft universe, since we use Outlook and Teams.

We haven't had any problems with scalability. We moved all devices from Windows 10 to 11 and it was very easy. We didn't need to test the machines. It worked very well.

We have 50 users of the solution.

The support from Microsoft is very good. Their chat system is very good because it's an alternative to phoning and it's very quick. Through the chat we quickly have someone to respond to our questions.

Positive

At first we used Panda, and after that we had McAfee. We replaced McAfee with Defender. Panda's client was very heavy on the device and, with McAfee, the benefit versus the cost was not so good.

Also, I spoke to colleagues at other companies that have implemented the solution and they said it's very simple to install.

We have seen ROI because there have been some attacks, but they have always been contained.

It's expensive because we have to pay for an M365 license and it is included in the package.

We tested Cisco Umbrella but the price was a little higher than Defender's price, and it would have been another product to install. Defender was almost "included," meaning it was easy to install.