Microsoft Defender for Cloud Apps Reviews

One thing our clients want to know is what cloud applications their users are using. When you enable Cloud App Security, you can sweep up all the applications that the endpoint is using, such as Dropbox, Box, or OneDrive. 

At Microsoft they use OneDrive and would probably want to restrict it to just that, unless there was a compelling reason to use a third-party application. With Cloud App Security, you can find all the users who are using Dropbox, for example, and then you can sanction those applications and prevent users from using them.

We also use that for alerting and creating policies for notifications and alerts.

The ability to prevent users from using certain applications is one of the most valuable features. It doesn't require any configuration for implementation from the client perspective. It just works right away and gives you the information you need. There are other features that you do need to configure. For example, the capability of the solution to discover the apps.

Another helpful feature is that you can add some connectors, not only from Office 365 and Azure, but external connectors. If you have logs from Palo Alto or Cisco, from  Barracuda, Checkpoint, or SonicWall, you can ingest them into Cloud App Security. It integrates well with third-party vendors.

There were things that were lacking but they are available in the newer version, such as an integration with the threat protection that Microsoft has with Microsoft Defender. However, I believe it's only set to be integrated with Microsoft Defender for identity and identity protection. I would like to see it available for use with something like Office 365 Defender. I don't think it's integrated with that yet.

I have been working with Microsoft Cloud App Security for three or four years.

We're a Microsoft partner, so we do pretty much anything Microsoft, including security, endpoints, and cloud. We don't do website or application development. We focus on architecture, infrastructure, security, and delivery.

It is stable. I haven't seen it go down.

You don't have to worry about the scalability because it's a SaaS application. As you add logs and data sources, it builds up. But you don't have to worry about the scalability because it's in the backend.

It's a little bit hard to deal with Microsoft tech support, especially on Cloud App Security. It's hit and miss. It depends on your type of support. If you have premier support, you get an okay type of response. They definitely need to up their tech support. There should be some improvement in that regard.

The initial setup is simple because it's software as a service. You don't build a server and you don't do upgrades. There is no OS. It's built into the cloud. All you have to do is purchase the license.

In terms of maintenance, it's all Microsoft. All you need it to do is configure it so that it will work for your unique environment, according to your organization's requirements. There is nothing else to worry about.

It comes as part of a bundle. If you have the Microsoft 365 license called E5, it comes with that. Otherwise, if you're going to buy it a la carte, the pricing can vary. Because we're a Microsoft partner, we get discounted pricing.

It doesn't require a long configuration process. There's no testing. You just need to tailor it to suit your organization's needs in terms of the data and the information that you want to get. In terms of discovering apps, it works pretty much out-of-the-box. It presents you with the data. The only decision that you need to make is whether to sanction an application. And then you have to sanction it and set up an alert if users are using a sanctioned application.

We have multiple virtual machines that we utilize in the cloud space with different applications on them. We utilize Microsoft Defender for Cloud Apps to monitor those individual application VMs as well as, along with Sentinel, our entire Azure ecostructure.

Microsoft Defender for Cloud Apps helps me, on the executive team, to have awareness and knowledge of what is going on in the environment. If a new administrator is created or one is trying to change their authentication types when they log in, or if new software gets put in there that should not have been there, we will get notifications on that.

Microsoft Defender for Cloud Apps helps automate routine tasks and the finding of high-value alerts. We depend a lot on automation. Some of the things I saw with the XDR window at this Microsoft Event are beautiful. I would like to see that. It ties in Defender, Sentinel, and all that into one pane of glass, which has been a problem at times. We see that as moving in the right direction.

It has helped us meet compliance requirements and has saved us costs. What we have now is an acceptable value.

Cloud Apps helps with detection, but I do not have metrics for how much time it has reduced.

It does a great job of monitoring and maintaining a security baseline. For us, that is a key element. The notifications are pretty good. These are the things that are very useful.

I would like more customization of notifications. Currently, you either get everything or you get limited information. I would like to have something in between where we can customize the data that is included in notifications. That is one thing. 

The comment field also needs improvement. If you want to generate a workflow within the organization for a notification that occurs, the comment field is not visible to the next person who logs in. They should make that a little more visible. They should make the history more available to the next person I assigned a task to.

I have been using Microsoft Defender for Cloud Apps for just over a year and a half.

It is very stable. I would rate it a ten out of ten for stability.

It is scalable. I would rate it a ten out of ten for scalability.

It is deployed across multiple locations and teams.

When we get a hold of the right people, it is great, but we are still trying to get a hold of the right people.

We were using another solution. It was not Azure. We switched in large part because that was a region-based company, and they ran into some issues, so we were left for a little while without a cloud environment. When I was comparing this with AWS, as an example, I picked Azure because of the general acceptance of the product in our market and in our space. I felt pretty comfortable going into it knowing that it would be there in five years or ten years as we grow.

I was involved in its deployment from an executive managerial position. It was complex. 

There were a lot of elements that were not obvious even to the point where the documentation was not keeping up with the production. So, we would hit a learning page, and the learning page would be about a prior product than the one we were looking at. It was not relevant to what was in production. My biggest recommendation for Microsoft would be that the learning pages need to be kept up-to-date and relevant to what is current in production.

We started with an integrator. We had challenges with that integrator, so we brought it in-house and finished it ourselves.

We have seen an ROI. We are a cloud service provider, so it is necessary.

Where we are right now, this is an acceptable pricing. I would like to see more transparency given to the end user. The end user given to us is via the cloud service provider. 

There are different programs and license models. Some include this, and some include that. It is all over the place. There can be a little more consistency or simplification in the pricing so that your parts list is not ten pages long, and you are not trying to determine, "If I have an E3, does this cover that?", or "Do I need to pay separately for the license?" Simplification would probably be better. 

To those evaluating the solution, I would advise knowing the goals they want to get to before they start. It can grow very quickly if you just build, but if you have a concept of where you want to end up and you stay within those constraints, then it is a great way to get there.

In terms of Microsoft Defender for Cloud Apps helping us to prioritize threats across the enterprise, we prioritize a little differently. I do not know if the solution helps with the prioritization of that, but prioritization is always important.

We get our threat intelligence from multiple sources. Microsoft Defender for Cloud Apps is one input on that, so it is hard to say whether its threat intelligence has helped prepare us for potential threats before they hit and take proactive steps.

I would rate Microsoft Defender for Cloud Apps a nine out of ten.

We primarily use Defender for Cloud Apps to authenticate users of our cloud applications. Defender validates the identity and allows the user to access the application. 

Defender helps us automate routine tasks. We can use templates to deploy various security solutions. It also consolidates our dashboards, so we can view everything from one console. 

Defender saves us time when responding to critical incidents. Typically, it takes about two or three days to find the root cause, but we can do this in four or five hours with Microsoft security solutions. Our detection time remains unchanged, but the response time is much faster. 

Defender's integration with our Identity solutions is critical in our current setup. It also integrates with Microsoft Sentinel to provide threat visibility. However, there's a delay of about 10 to 15 minutes from when Sentinel detects an incident, and it appears in Defender. We're trying to fix that. 

Defender allows us to prioritize threats across our enterprise, which is crucial. It's easy to integrate Defender with other Microsoft solutions. For example, we use Defender with Sentinel and set conditional access policies in Azure Active Directory. We're currently participating in Microsoft training to learn how to utilize these solutions better.

Defender could integrate better with multi-cloud and hybrid environments. It requires some additional configuration to ingest data from non-Azure environments and integrate it with Sentinel.

We have used Defender for Cloud Apps for a year.

Defender is stable.

Defender is scalable.

I rate Microsoft support eight out of 10. 

Positive

Defender is a cloud-based solution, but our deployment was complex because we have a massive environment. It took us about a month to fully deploy it, including testing and evaluation. I had a five-person team, including engineers, administrators, and management. There is no maintenance after deployment because it runs on Azure infrastructure.

We haven't saved money, but we save time because the integration with Microsoft products is seamless. 

Defender is costly. Still, we get a lot of features, and it's easier to integrate with our other solutions, so it's worth what we pay for it.

I rate Microsoft Defender for Cloud Apps nine out of 10. As a security architect, I would generally recommend a multi-vendor solution with a zero-trust model. However, if you are mostly using Microsoft products, it might make sense to use the Microsoft security suite because of the native integration.

We use Microsoft Defender for Cloud Apps for endpoint management.

It is good for compliance and is effective from the standpoint of risk management.

The most effective features for data protection are data loss prevention (DLP) and data classification.

The product is very good so far, however, it would be better if it could include more up-to-date threat protection.

I have used it for almost two to three years.

The solution is stable, and I would rate it a nine out of ten.

The solution is scalable, but I would rate it between six to seven out of ten.

Microsoft technical support is very good, and I would rate it nine out of ten.

Positive

The setup process usually takes five to six hours. However, from installation to configuration, it took a lot of time in our case.

The maintenance is done by a different team, and we support that maintenance.

There is financial benefit from using the product, however, I don't have the numbers currently.

Honestly, it is expensive. I would rate the price as eight out of ten.

It is always better to contact the technical team for any feedback because they are the engineering team.

I'd rate the solution nine out of ten.

Mainly, companies use it for end-user compute devices. 

It has provided more centralization for managing endpoint security. We have greater flexibility. We can have people manage it from anywhere. I could be working from home or on-prem. That's a great thing about the cloud. The portal is accessible anywhere in the world as long as you have an internet connection. It doesn't really limit you from where you can work or manage it.

It's an in-depth tool. It pretty much logs the events line by line, and with the portal, it just makes it searchable on a wider basis. We've got greater visibility than we used to have from historic products.

It helps to prioritize threats across the enterprise. Your AV is now your footprint, which means you can footprint files faster than you can provide a patch. That is the whole idea of security solutions these days. Sophos used to pioneer using file footprints to basically stop stuff at the front door. So, if you got an EXE or something else, such as a JavaScript file or JSP, or any nefarious malware, Trojans, they footprint the file. Such a file will get scanned and blocked. That's the whole idea of it. It can't ever execute on the machine. 

It helps automate routine tasks and the finding of high-value alerts. It allows us to pinpoint threats and automate the boring stuff. Any automation or AI is a good thing.

It eliminates having to look at multiple dashboards and gives one XDR dashboard. I've one dashboard, and it's a unit. So, there is a unified approach. 

Having everything in one place helps because the engineers don't have to log into multiple places to find something, and they can put in best practice rules quicker. If they want new ASR rules, they can put them in. One of the things that security engineers do is create alerts in there. If they want to alert for a specific threat and just create a query, they'll run it through the system, or they put an alert for specific file extensions that might execute, such as ICU.7ZZ. There are code obfuscations and file obfuscations, and they can search for those things. They'll put alerts on for them.

This centralization saves us time. Because it's all in one portal, we can search across all endpoints we manage. That's the whole idea. The automation has probably saved an engineer between 10% to 20% of the time. It's something we just plug in and leave to work. It gets tweaked every now and again. Since I have implemented it, the tickets I've got from the security department and the infrastructure have gone down to about 10% to 15%. Once the rules are in place, they're there forever or as long as the product life cycle lasts.

I am not sure if it has saved us money because that's finance-related. It's probably more about uptime if you can keep threats off the end-user devices and don't have to rebuild them. I don't recall seeing a virus on my PC here in the current client I've worked for in the last five years. If you got a virus on the device, you just have to rebuild it. I don't remember having seen any rebuilds here. They are only for new users.

It reduces the time to respond. Your portal is a few clicks away. The fourth-line engineer can assist the security department within five minutes. Generally, we just get a Teams message if they need assistance or they raise a ticket. It depends on if it's a structural change or if it's a reactive response.

On-demand scanning is the most valuable feature. In addition, it's a fairly fluid product. It syncs back to the cloud and provides metrics. It's pretty intelligent.

They need to improve the attack surface reduction (ASR) rules. In the latest version, you can implement ASR rules, which are quite useful, but you have to enable those because if they're not enabled, they flag false positives. In the Defender portal, it logs a block for WMI processes and PowerShell. Apparently, it's because ASR rules are not configured. So, you generally have to enable them to exclude, for example, WMI queries or PowerShell because they have a habit of blocking your security scanners. It's a bit weird that they have to be enabled to be configured, and it's not the other way around. Normally, you'd expect when something is not configured, it doesn't enable itself, but for the purpose of this, apparently, Microsoft has told us to enable them. So, you've got to enable them because they keep flagging and blocking products even when they're not configured. It was just an oversight in the design department when they deployed an update to the feature, but I'll live with it.

I'd like to see them automate best-practice antivirus rules. If you search Microsoft best practice antivirus exclusions, there are virus scanning recommendations for antivirus computers running Windows or Windows Server. There is a whole list to exclude the most common things, which could be anything from NTFRS, check folders, temp.DB, or EDBs. There are a lot of things for group policy extensions, exclusion, etc. This is a list of best-practice antivirus rules, but they still have to be implemented manually. In Sophos, five or six years ago, if it was a SQL Server, they automatically included the rules to exclude certain folders or file extensions when doing on-demand scanning. I'd like Microsoft to do the same.

I have been using it in my professional capacity for five years.

It's greatly stable.

It's definitely scalable. My current client has 2,000 users.

They're excellent. I would rate them a 10 out of 10.

Positive

I've previously used Symantec, which for some is the greatest product. My top two are Sophos and Microsoft Defender for antivirus or web filtering. Symantec doesn't really come close to these two.

Microsoft Defender is probably now accepted as the best product on the market for antivirus and web filtering. Five or ten years back, there were Symantec and others, but Microsoft has basically built a competitive product to rival those that used to do this kind of thing. Businesses are just happy to accept that it works. It's expensive, but it does what it says on the tin.

The legacy products, like Symantec, on servers and clients no longer work. They require a lot of manual configuration, and they also don't protect the PC or server as well as Defender, which is also more cost-effective. It's already built into your home PC's operating system. If you've got a business PC, it's built-in. With Defender for Cloud Apps or Defender Endpoint management or InTune, you've got the management of the PC, which is what this pays for.

It's cloud-based and deployed through InTune. The device has to be registered, and the device also has to be in the right license period.

The initial setup is straightforward. We use InTune to roll it out. The actual component is already on the Windows PC. It's called Windows antivirus or Defender. From the business side, by putting the devices in InTune, we can gather the metrics from the PC through Defender for Cloud Apps, or the Defender Endpoint management portal. It gives you a bit more management of the PC from that perspective.

In a reasonable deployment, it takes at least a week to deploy. The PCs have to be in InTune first to roll it out, and then, it's generally a matter of just switching on the feature.

For most businesses where I worked, it took a period of time to realize its benefits from the time of deployment. As the product got developed and became more mature, it got greater functionality in the end. It's now a mature product. The initial deployment was done when I was here, but I've been involved in enabling the maturity of the product's life cycle. There were always lots of tickets for changes regarding Microsoft Defender for Cloud Apps. It's a very intelligent product.

In terms of the number of people, sometimes, you need one person and sometimes two. Generally, you're trying to do things in the background.

It doesn't require any maintenance in particular. It's mainly just the configuration of rules and policies and then the security department does the rest and watches it.

The ROI is there. It's the uptime. You don't want end-user devices going offline. It disrupts the business for that user. Every time a user is down or the machines are being rebuilt because of a virus, it's downtime for the business. They can't do their work at that point in time. Increased uptime is always better on end-user compute devices or servers.

It has fair pricing. You pay for what you get. As far as I know, there are no costs in addition to the standard licensing fee.

It's probably one of the top three on the market. You've got Defender and then you've got Sophos, and then, I suppose the other one that comes close is probably Norton. These are probably the top three. I am not really a fan of Trend Micro products or Kaspersky.

I would recommend implementing it. It's the number one product in the market. The only thing they should automate is to put AI on their virus scanner recommendations rather than having to enable them by default. They might already have done that, but from what I've seen, generally, they do things manually.

At the moment, we are not using other Microsoft Security products. We are mainly using Defender. I have previously made use of the Defender for Cloud's bidirectional sync capabilities, which I'd rate a 10 out of 10.  

Overall, I would rate it a 10 out of 10.

We utilize Microsoft Defender for Cloud Apps in conjunction with Defender for Endpoint. This enables the Cloud App to effectively block unauthorized websites for users. Additionally, it allows us to prevent users from accessing malicious sites, and we can restrict user access based on their device compliance status.

Microsoft Defender for Cloud Apps offers visibility into the usage of enterprise applications and the connections established from both authorized and unauthorized locations and devices.

Microsoft Defender for Cloud Apps, in conjunction with Defender for Endpoint, helps prioritize threats throughout our enterprise by reviewing them, identifying devices with vulnerabilities, and providing us with criticality assessments and recommendations on resolving the issues.

We utilize the complete Microsoft Defender suite, which includes Defender for Endpoint as well as Defender 365. The integration is seamless; we only need to onboard Defender for Endpoint, and it functions exceptionally well.

The integrated solutions work natively together to provide coordinated detection and response across our environment. If Defender detects a malicious email, it will notify me of the detection, block the email, and apply the same actions to all the emails that match the same criteria.

I appreciate the comprehensiveness of the threat protection offered by Microsoft security products due to their functionality and ability to integrate, which other products may not offer.

Microsoft Defender for Cloud Apps has helped improve our visibility and response time.

It helps automate the discovery of high-value alerts. The solution can identify malicious threats and subsequently block the threats while disabling the compromised account automatically.

Microsoft Defender for Cloud Apps has helped us save time through the visibility it provides.

Microsoft Defender for Cloud Apps has significantly reduced our time to detect and respond by several hours through its integration with the rest of the Microsoft Defender suite, thereby reducing our troubleshooting time.

The most valuable feature is its policy implementation. Even public websites are directed to the Microsoft Net proxy, where we can establish policies to determine whether to block, authorize, or manage devices.

Currently, we are only able to utilize the policies for blocking threats. I would prefer to have filtering options incorporated within the policies, enabling the solution to perform tasks beyond mere blocking or allowing.

I have been using Microsoft Defender for Cloud Apps for one year.

Microsoft Defender for Cloud Apps has been stable thus far.

Microsoft Defender for Cloud Apps is scalable. We are not limited by Microsoft in terms of the number of users or devices.

The initial setup is not straightforward due to the numerous meetings beforehand, and the Microsoft documentation can be overwhelming. However, once we familiarized ourselves with the interface, it started making more sense. 

The deployment process took over three months. Initially, we tested the solution to become familiar with it before deploying it to a small number of users. Once we were confident that everything was working correctly, we proceeded to deploy it to all users. Two system engineers were required for the deployment.

The implementation was completed in-house.

We have seen a return on investment with Microsoft Defender for Cloud Apps.

We utilize the Microsoft E5 licensing, which encompasses the entire Microsoft suite; however, it is costly. Furthermore, there are supplementary expenses associated with add-on modules.

I rate Microsoft Defender for Cloud Apps an eight out of ten.

Microsoft Defender for Cloud Apps promptly generates an alert upon detecting a threat. However, I do not believe it has the capability to proactively defend against potential threats.

It is deployed in one environment with 50-plus users.

No maintenance is required from our end.

I recommend that anyone evaluating Microsoft Defender for Cloud Apps should read through all of the documentation first.

We help develop and mostly support applications for clients. It creates reports for clients. It works with Microsoft SQL Server and can tell clients if they need some governance standards for user security profiles. For example, if they are using Linux VM, then there are some security updates that come up. If they haven't been updated, they get a prompt telling them, "Look at this CSV security vulnerability. It should be updated as this part of your application."

We have our main office in Lagos with other offices in the UK and America. Due to COVID, we are mostly working remotely and having meetings online. There are 55 endpoints.

Due to COVID, most of my users are remote. Because of that, we need to manage their applications and let them log on from home. They also have their own personal devices that they are using. So, we have to give them access to those.

My staff uses personal devices that seem to always have issues with malware. So, it notifies me if there is an issue. I can check their usage and the audit logs, e.g., when people logged in last and if they are logged onto a tenant, to see where the issues are. We might tell them to change their login details or reset their two-factor authentication if there is an issue.

They don't have access to the desktop Microsoft Defender Antivirus suite. I need to manage it from the cloud, where I restrict access to the account. They can download a zip file to a folder, then do whatever they want, but I don't give them freedom anymore because the users are always having issues.

When our CEO travels, someone is always trying to hack into his account. We have banned Russian IP addresses, as this is where most of the threats are coming from.

There are security settings that report and advise you on your security settings. The governance reports give you guidance on security vulnerabilities and how to remedy them.

It tells you whether something is high, middle, or low risk, giving you a risk profile. It lets you know which one to handle first.

Everything from Microsoft is integrated. You receive regular reports on them all. You can push your reports, logs, and security alerts, which are all integrated. It is crucial that these solutions work natively together to deliver coordinated detection and response across our environment.

This Microsoft security solution has helped eliminate the need to look at multiple dashboards and given us a single XDR dashboard. This is one of the main features that we like about the solution. We have one dashboard. Anybody who is a part of the security team can look at it and say, "Okay, this is what I noticed." Then, we can have a short discussion on how to remediate or enhance services.

I would give the comprehensiveness of the threat-protection that these Microsoft security products provide a high score. 

Sometimes, Microsoft sends us information and recommendations about changing all our configurations due to something they noticed. So, their reports improve our uptime availability and provide a seamless service for our clients. 

The visibility is 85%. Sometimes, it takes too long to load your page because Microsoft is having issues. There are a certain amount of hours in a day to solve and rectify issues. If you deploy this solution for a client, you need to be able to respond or rectify issues. Because if the solution goes down, your clients won't be happy with you.

We would like to get more information from the endpoint. I don't get enough detailed information right now on why something failed. There is not enough visibility.

The cost could be improved when you need to pay for anything. For example, refreshing files takes time to load, though it may be my Internet. To improve the refresh time, Microsoft says that we need to pay for a Premium license, and I don't like paying for things that help make a solution better.

I have been using it for three years.

The stability is about 95%. I have called and complained to Microsoft about the downtime.

It doesn't require any maintenance.

Sometimes it will take time for Microsoft to respond to technical issues. However, once they start working on an issue, they will try to resolve it. I would rate the technical support as eight out of 10.

Positive

We didn't use another solution prior to this one. We have always used Microsoft.

The initial deployment was straightforward. Afterward, there were issues due to licensing issues moving from Google to Microsoft. It was not free.

It took a couple of hours to make everything work to our specifications. I tried to automate as much as I could with scripts.

I migrated my clients from Google to Microsoft.

Our reaction time is now faster when eliminating problems. We see the generated reports and logs much faster than before when we have to go to different places.

It reduces support calls for internal users. For example, it reduces the number of times that internal callers contact support for password issues.

Issues that frequently used to take support an hour are now only happening every blue moon. This is largely due to the predictive trend reports from the solution.

We have seen a 35% to 45% cost reduction with this solution.

You can activate a free tier of use for a period of time.

When the SolarWinds vulnerability came up, that caused a lot of issues. Our clients got regular updates. It did a scan for them, so they didn't have to start worrying. That was the free tier. 

With the other tiers, you pay more for each feature it gives you, e.g., the security push or regulatory compliance, without you paying extra for that too, which has been advantageous.

We also use Microsoft Defender for Cloud. With other models, you need to pay for an agent, and there is a cost. I don't like spending money. So, we use the free ones a lot. We evaluate the solutions that we need to pay for on a case-by-case basis, then we can decide if we really need them at all.

Sentinel would probably be the cheapest of all SIEM and SOAR solutions. I am not paying for everything because it is hosted by Microsoft. I am not paying the infrastructure costs. The app of this solution is updated regularly. I don't have to worry about that. So, the cost is very cheap for me, except when I have to pay for specific agents. Then, I have to think about the cost.

There are costs associated with SQL Server and Linux as well as their agents.

Microsoft makes sense because it integrates with many applications and provides. However, it depends on your infrastructure.

Endpoint Security is part of the Microsoft Defender suite. We use it to manage systems and force them to update. They can also revoke access to a tenant.

Microsoft Sentinel logs all our reports. This gives us better visibility. This enables us to ingest data from our entire ecosystem. It also allows us to provide security posture reports to our clients. Before starting a contract with a business, we create a report and give that to clients, showing how we handle and solve problems. The report shows our environment and uptime. 

Sentinel enables us to investigate threats and respond holistically from one place. From there, we can now troubleshoot where the issue is coming from. This is for our endpoint or when my external users are trying to access the service. This is very important to us because it makes life easier. We don't have to start running around checking this interface with another interface and a third or fourth interface. It is a single interface and we can get more raw data than what we configured Sentinel to ingest.

The comprehensiveness of Sentinel’s security protection is very high. We don't really use other providers. We use it to connect to AWS or Google Cloud Platform infrastructure to get information on how deployed loads are performing.

I would rate them as nine out of 10.

We use it to protect our users' devices against attacks. 

We see stories about attacks in the news, including phishing and spam, Defender helps protect us.

It also gives us an ecosystem. We have one portal where we can manage everything. We don't need to log in to another portal to manage the devices, the antivirus, Defender, or Office. It's a single place to manage everything and that's very good.

It's very easy to install and it includes the Intune portal from Microsoft where I can control all the devices from one place. And because it's a Microsoft product, it integrates with Windows 10 and Windows 11. We don't need to buy anything else.

We have an M365 license and we have an Office admin portal. I manage all the users and licenses through the portal, making it very easy to manage. We have a lot of users coming in and going out of the company, and this makes it simple to provide licenses to people.

I would like to see them include more features in the older licenses. There are some features that are not available, such as preventing or analyzing cloud attacks. We have Defender P2 licenses and Microsoft proposed P3. If it included what was in the old package, such as the M365 license and Office, that would be very good.

I have been using Microsoft Defender for Cloud Apps (MDA) for two years.

The stability is very good. We haven't had downtime. When we receive a message that the service is down, it's only for a few minutes and then all is good. That's true for the whole Microsoft universe, since we use Outlook and Teams.

We haven't had any problems with scalability. We moved all devices from Windows 10 to 11 and it was very easy. We didn't need to test the machines. It worked very well.

We have 50 users of the solution.

The support from Microsoft is very good. Their chat system is very good because it's an alternative to phoning and it's very quick. Through the chat we quickly have someone to respond to our questions.

Positive

At first we used Panda, and after that we had McAfee. We replaced McAfee with Defender. Panda's client was very heavy on the device and, with McAfee, the benefit versus the cost was not so good.

Also, I spoke to colleagues at other companies that have implemented the solution and they said it's very simple to install.

We have seen ROI because there have been some attacks, but they have always been contained.

It's expensive because we have to pay for an M365 license and it is included in the package.

We tested Cisco Umbrella but the price was a little higher than Defender's price, and it would have been another product to install. Defender was almost "included," meaning it was easy to install.