Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is Selected

Description:

This setting enables Microsoft Defender for Cloud Apps (MCAS) integration with Microsoft Defender for Cloud.

Rationale:

Microsoft Defender for Cloud offers an additional layer of protection by using Azure Resource Manager events, which is considered to be the control plane for Azure. By analyzing the Azure Resource Manager records, Microsoft Defender for Cloud detects unusual or potentially harmful operations in the Azure subscription environment.
Several of the preceding analytics are powered by Microsoft Cloud App Security. To benefit from these analytics, subscription must have a Cloud App Security license.

MCAS works only with Standard Tier subscriptions.

MCAS works with Standard pricing tier Subscription. Choosing the Standard pricing tier of Microsoft Defender for Cloud incurs an additional cost per resource.

From Azure Console

1. Go to 'Microsoft Defender for Cloud'
2. Select 'Security policy' blade
3. Click On 'Edit Settings' to alter the the security policy for a subscription
4. Select the 'Integrations' blade
5. Check/Enable option 'Allow Microsoft Defender for Cloud Apps to access my data'
6. Select 'Save'

Using Azure Command Line Interface 2.0
Use the below command to enable Standard pricing tier for Storage Accounts

az account get-access-token --query "{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/settings/MCAS?api-version=2021-06-01 -d@"input.json"'

Where input.json contains the Request body json data as mentioned below.

{
"id": "/subscriptions//providers/Microsoft.Security/settings/MCAS",
"kind": "DataExportSetting",
"type": "Microsoft.Security/settings",
"properties": {
"enabled": true
}
}
.