Detections
Analytics

2.4.3 (L2) Ensure Microsoft Defender for Cloud Apps is enabled and configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB). It provides visibility into suspicious activity in Microsoft 365, enabling investigation into potential security issues and facilitating the implementation of remediation measures if necessary.

Some risk detection methods provided by Entra Identity Protection also require Microsoft Defender for Cloud Apps:

 - Suspicious manipulation of inbox rules
 - Suspicious inbox forwarding
 - New country detection
 - Impossible travel detection
 - Activity from anonymous IP addresses
 - Mass access to sensitive files

Security teams can receive notifications of triggered alerts for atypical or suspicious activities, see how the organization's data in Microsoft 365 is accessed and used, suspend user accounts exhibiting suspicious activity, and require users to log back in to Microsoft 365 apps after an alert has been triggered.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft 365 Defender https://security.microsoft.com/
 - Click to expand System select Settings > Cloud apps.
 - Scroll to Information Protection and select Files.
 - Check Enable file monitoring.
 - Scroll up to Cloud Discovery and select Microsoft Defender for Endpoint.
 - Check Enforce app access, configure a Notification URL and Save.

Note: Defender for Endpoint requires a Defender for Endpoint license.

Configure App Connectors:

 - Scroll to Connected apps and select App connectors.
 - Click on Connect an app and select Microsoft 365.
 - Check all Azure and Office 365 boxes then click Connect Office 365.
 - Repeat for the Microsoft Azure application.

See Also

https://workbench.cisecurity.org/benchmarks/22162

Item Details

References: CSCv7|6.2, CSCv7|16

Plugin: microsoft_azure

Control ID: f69c6bf8adf70eeead7677e4a2fc2760e9f7885850a5d58675a2c9ad0b408593