Know Your Stack:
Microsoft Defender for Cloud Apps

Jazzy: And we're back at it again. Hello. Hello. Welcome to Defender for Cloud Apps, part three of our lovely Know Your Stack series.

Redouan: Exactly. Good afternoon everybody, depending where you're calling in from. Let's see if I can present here, because it's not letting me present at the moment.

Jazzy: How's everyone doing? How are we all? We have a broad range of countries visiting us today.

Redouan: Oh, there we go.

Jazzy: We got someone from your neck of the woods, Red.

Redouan: Nah. Oh, really? Oh, that's cool. That's cool. So in the first part of the webinar series, we had people from all over the world. So please let us know where you are from. I can see some people from the Netherlands already, Switzerland, Denmark. That's cool to see. Reykjavik, Iceland. Wow. Also cool.

Jazzy: Oh, I love that. I love that we got Icelandics in here.

Redouan: We got someone joining us from the airport.

Jazzy: Yeah. What airport is that? Kalonia. Where is that? Is that Cyprus or Greece?

Redouan: Bro, I wouldn't even try to guess with that many people watching you, man.

Jazzy: Maybe not worth it. Maybe stay quiet and get all my countries wrong. But Kalonia, I'm really intrigued where that is. Oh, it is Greece. Yeah, it is Greece. I was right. Look at that. I know a bit of Microsoft and I know a bit about countries. Maybe that's going on my CV now: I know where Kalonia is.

Redouan: "I feel boring being in the US."

Jazzy: The US is just as fun. I've never been, probably that's why I'm saying that.

Redouan: Ireland as well. Cool. Cool. Love that. Well, thank you all for joining us, especially the people that have stuck around since episode one and episode two as well. Clearly we're not that much of people that put you to sleep, so thank you for staying on. We love it. We absolutely love it. Should we get going? Start it off.

Jazzy: Yes. Yes.

Redouan: Intros. Jazzy, you always go first, so be my guest.

Jazzy: It's probably because I am on the left hand side, and I'm never right, as my MS always tells me. Microsoft fanboy, absolutely love everything about Microsoft. I have been working with Microsoft for a very long time now. Love configuring it, love doing it. And the good news is I'm no longer the unpaid IT department for my parents. If you've been around since episode one and episode two, you know that's what I've had to do for so long. But that's because my parents have a new neighbour who's an IT support engineer, and he's been helping them out, believe it or not. They actually knocked on the door and asked them for help configuring a phone setting, and that actually did work out. So hey ho, here we go.

Redouan: They knocked on their door.

Jazzy: Yeah, they had a chat outside and they figured out that he's in IT. I don't believe he's an IT support engineer. He may be someone that mentioned it once and my parents just decided that's it, he knows computers, he can help us out. My career has always been MSPs. I know how to manage many tenants at a time. I don't know how to manage the one. Never been internal. Maybe one day. Maybe one day.

Redouan: Imagine going to live in a new neighbourhood and your parents just knocking on your door saying, "Hey, can you help me with this IT question real quick?" That's the best use case. So I have been upgraded to the official managed service provider for my whole family plus in-laws. So Jazzy's doing a better job than I am, because I'm not really getting paid for it. So I'm a pretty shitty MSP as well. Apart from that, I've also worked at an MSP for the past couple of years, just like Jazzy. Also a Microsoft fanboy. I just love configuring Microsoft and everything around it. So that's why we're here as well, right? That's why we're discussing Defender for Cloud Apps today. Clearly you adjusted the last bottom bit, because I wrote down episode three. Still hasn't sent me anything, so I haven't updated it. I've just stopped asking at this point.

Jazzy: You're doing a great job by editing your own bio. I have put in one line there.

Redouan: So that's great. Love it. Let's see. Defender for Cloud Apps. So we are going to discuss what Defender for Cloud Apps is, what you can use it for, and what it replaces. So maybe you already have some third party tooling, third party applications in place that do some things that Defender for Cloud Apps also does, or it has some overlap. So you might not need those third party applications. And then we're going to discuss the actual inner workings of Defender for Cloud Apps: how do you configure it, what are the possibilities, what are the catches when it comes to Defender for Cloud Apps?

Jazzy: And last but not least, what gets missed, and when would you reach for it? We're also going to give you a quick checklist as well, just like we did in the last webinar. Now obviously I don't want to promise everything, because we like to underpromise and overdeliver, but if we have any time left over we'll try and give you a little demo of what Cloud Apps looks like and what you can do with it.

A few things that we've seen, starting off with, I guess, the app problem. Now, the numbers that you see here on your screen are directly from Microsoft and it may not be the case for absolutely everyone, but whenever you ask an IT admin how many apps a user or an estate of a business uses, it's usually what, 30 or 40 apps, with five or 10 of them being Microsoft 365? And then it turns out, if you actually start looking at the applications that people have logged into, used, browsed on, any SaaS application, it's thousands and thousands of applications that they've touched upon and we have absolutely no idea what they're doing with them. And usually 80% of those employees are using unsanctioned apps that we probably don't want them to be using. But realistically, I completely understand that in a 40 seat client it's not that high, but the estimations remain the same. You're thinking they're using tens or 20s, but in actual fact it's hundreds. And it's nice to know what people are using and to be able to monitor and control them. But that opens up a whole other can of worms, right? Once you find out what they're doing, that's a bigger problem. Now you have to solve it.

Redouan: Exactly. I also want to emphasise the amount of cloud applications being used. I have a tenant of my own that I've just set up a couple of weeks ago. I've been working in it for a couple of weeks. I already have 66 cloud applications there, and I'm just by myself for a couple of weeks. So I can assure you, if you have an organisation that you're managing, even if it's just, like Jazzy said, 30 people, 40 people, there's probably hundreds of cloud applications in use right now, and if you have no visibility over them you cannot fix anything either. So that's the main premise of getting that discovery in first when it comes to your cloud applications.

Jazzy: Definitely.

Redouan: What is Defender for Cloud Apps? Microsoft actually frames it quite similarly to how we're framing it right now. Most of it starts with discovery. So we need to know what's there in order to actually enforce something and to monitor something. So discovery is first when it comes to Defender for Cloud Apps. Posture management is usually connecting in external applications and being able to manage the posture for external applications. We'll dive into that in a bit, but you can actually connect those applications and get an overview of how they're configured. Protecting data: Defender for Cloud Apps does have some visibility into actual files being uploaded and stuff like that. It can also work with classifications, or labels and classifications of data, and you can also put in some actions there, or actually enforce some actions. Detecting threats: Defender for Cloud Apps does alert and does have UEBA, for instance, in it as well. We'll dive into that as well. OAuth apps, which is a really important one. Of course the OAuth apps reside within Entra ID, so you have all of your enterprise applications there. But when it comes to governing those apps and the API permissions, that's something that's done from within Defender for Cloud Apps more easily than within Entra ID, and you guys will be able to see that as well. And then controlling in real time: you can configure some session policies that will give you, yeah, what's the correct way of phrasing it, Jazzy? How would you phrase it?

Jazzy: In terms of session policies, they are what you allow them to do once they're in. You can help with blocking and deleting, and blocking copy and pasting, things like that. Whereas an access policy helps you stop them accessing an app completely. And we'll talk about access policies and session policies shortly. But the idea behind all of this is you want to know what your cloud apps are doing and you want to discover them to begin with, and then you want to start protecting the data and apply governance actions against them. Especially apps where Entra ID provides you with a list, but not necessarily what each of the permissions are doing without you having a look. And if you guys remember episode one, Entra ID hardening, if the consent policies for app registrations haven't been followed properly, you may have an app sprawl. And if that is the case, well, you can use Defender for Cloud Apps to rein some of that stuff back in case it was misconfigured to begin with.

Redouan: Exactly. Of course, we can't talk about anything Microsoft related without talking about licensing, so we will have to talk about licensing. And there is a big difference in this webinar in comparison to the last couple of webinars we did, because in the last couple of webinars we talked about it already being included within Business Premium and that you should configure it since you have it. You probably have it. Whereas with Defender for Cloud Apps, it's actually really limited what you have within Business Premium, and if you want to have all of the capabilities you would need to have the actual license. So that can be the Defender suite add-on, for instance, or a full-fledged E5 license. So if I just hop back one slide, to put it in simple words, the first one, discovery, is really included. That's actually included within Business Premium, but the rest of it usually is not. So discovery is really the only thing that you get within Business Premium. We will discuss the other functionalities as well though. Like it says in the slide, Business Premium is all about discovery, so we can only see what is actually going on but we cannot enforce anything. And then within the Defender suite for Business Premium, that's where you get the full Defender for Cloud Apps and all the full functionalities. And of course we're going to talk about licensing, so m365maps.com is going to be included as well. Unfortunately the slide is not working. Yes, of course. Why would it? So in the bottom right corner there, it should say m365maps.com. So I'm really sorry for the guys there, but I always like to do a shout out for them. Just to emphasise, it says enterprise. So this is included within Business Premium, the cloud app discovery one. I'm sorry, wrong again with the pencils. Thank you, Don Bes.

Jazzy: Yeah, thank you.

Redouan: You're a lifesaver. Don Bes in the chat. So you can see that only cloud app discovery is actually included within Business Premium. For all the other functionalities you need the full Defender for Cloud Apps license.

Jazzy: What everyone's now realised by this point is that although we love Microsoft, we're not great PowerPoint guys out here. We do apologise.

Redouan: Hey man, I'm Microsoft 365, not Office 365. So, love that.

Jazzy: Yeah, in terms of what it replaces, a lot of us, even in my old place, my old MSP, we tend to use a lot of third party tools. We had tools that were doing some shadow IT discovery, third party tools. We had CASB and SaaS access control, things like SaaS scanner, and then other protection apps that we have that are looking at the endpoints and the edge nodes to figure out what's going on and control some of the web browsing, content filtering, things like that. Now ultimately the idea behind this is: how can we manage less tooling, right? How can we bring it all in? So there are a lot of third party apps that you may be currently using, and some categories that you already purchased and have a subscription for, where we can bring it back into the Microsoft house. So ultimately there's a couple of things: yes, we're giving Microsoft a little bit more of our money, but then it allows us to be proficient and experts in one sort of vendor, which is not always the best thing, but it does help us with the integration between other applications like Defender for Endpoint, and having identity, Entra ID, pushing into it, having Defender XDR. It just allows you to bring it all in one, I hate saying this, but one pane of glass, right? It makes it a lot easier. The sales guys are getting to me.

Redouan: Yeah, one pane of glass. And in Microsoft terms.

Jazzy: Yeah, in Microsoft terms absolutely, one tenant.

Redouan: Yeah, pretty sure that Microsoft says one pane of glass about Lighthouse as well, but I won't dive into that.

Jazzy: That's the one thing that does slightly worry me: nowadays these buzzwords are getting to me, and I realise that actually when I'm speaking to people I'm using them more and more, and inside me little Jazzy is just getting a little bit upset with myself. Maybe I should stop using those buzzwords.

Redouan: Let's dive into how Defender for Cloud Apps actually works. And of course, like I said, it all starts with the discovery. So how do we actually get visibility into those cloud apps that are being utilised within the organisation? There are multiple routes of ingesting logs within Defender for Cloud Apps just in order to get that visibility, and once you have the visibility then you can act on it. But that's a step after this. So for now, when it comes to ingesting logs, for, I want to say, probably 85% of MSPs or 90% of MSPs, you will always go for the Defender for Endpoint integration, since all of the other ones are more enterprise based. If you have some firewalls in place, for instance, and everything is routed through the firewalls or stuff like that, you can use that and you can ingest those logs. But if you are utilising Defender for Endpoint it makes way more sense to just ingest those logs into it, and we will dive into the process of actually enabling that integration. But that is the most simple way, and I also want to say the most reliable way, that just works out of the box. Anything that you wanted to add as well, Jazzy?

Jazzy: No, that makes absolute sense. I mean, the idea behind some of this is also that you don't necessarily need to stop using any existing apps that you already have that have collected all that data already. You can use the existing secure web gateways to bring data back into Defender for Cloud Apps as well, in the cloud discovery. You can use it to connect existing gateways. So it is insanely helpful to even run side by side for a little while before you decide if you want to move into Microsoft completely.

Redouan: I saw in the chat that Nick says the data flags for shadow AI is scary. Yes, it is. I've had so many organisations where I configured a project, Defender for Cloud Apps was not in place, and I configured just the cloud discovery, so that's the integration with Defender for Endpoint. And I can guarantee you there will be tens, maybe 20 applications that the organisation is just not aware of. Dropbox, for instance: people are moving files to Dropbox. They're using all kinds of AI applications. They're using unsanctioned AI applications. So yes, it does give you the visibility that you need in order to start the conversation to go to full Defender for Cloud Apps where you can actually enforce stuff. So yes, definitely.

Jazzy: Hopefully we can show you some of the stuff in the portal as well later on, to show you what the cloud discovery looks like.

Redouan: As a screenshot here. Anyway, yeah, so I did include a little screenshot. So if you've configured the cloud discovery prerequisites, it will show up in this dashboard over here. It's in the Defender XDR portal under Cloud Apps and Cloud Discovery, and it will show you all of the cloud apps that have been monitored, or that you have visibility of.

Jazzy: Discovered.

Redouan: Yeah, that's a way better word. Yeah, cloud discovery. It already says it in the title. Why am I making it so difficult?

Jazzy: Look at me. Geography, literature and Microsoft, on the full.

Redouan: Oh, yeah. Yeah. Yeah. On the full package.

Jazzy: Don't ask me any more questions. That's it. That's done. That's as far as my expertise goes for today. I think I've peaked. I have peaked by giving you the word discovered.

Redouan: I'm gonna have to step up my game in the next webinar.

Jazzy: Learn about me so that I can add it into your introduction. That would be the best start. Perfect. Did you want to take it, or am I doing blocking as well?

Redouan: Perfect. Okay. So the step from discovery to actually blocking applications is really important, of course. So this is actually where Business Premium does not, where this functionality is not included. There are three different options when it comes to doing something with a cloud application within Defender for Cloud Apps. You can monitor them, you can unsanction them and you can sanction them. Unsanctioning is basically the only tag that you can give that actually enforces something, that actually blocks the cloud application. It's also blocked on the network level, so it doesn't matter if you go through Google Chrome or if you go through Edge or whatever, the cloud application will be blocked. Also really important: what actually does the blocking? That's something that didn't click with me for maybe six months, up until I configured it multiple times. But Defender for Cloud Apps just talks back to Defender for Endpoint. So whenever you tag an application as unsanctioned that doesn't necessarily mean the cloud application is blocked, because Defender for Cloud Apps still needs to have the integration with Defender for Endpoint, and Defender for Endpoint actually has the indicators that block the cloud application. So you can unsanction a cloud application in the portal, but that doesn't mean that the application will be blocked, because you need to have all of the prerequisites in place. And I think that's also exactly the same thing that is in the third point: tagging is not necessarily enforcing. So that's something that you do need to realise. You need to have all the prerequisites in place, and it takes some time in order to actually block the application. So even if you have all of the prerequisites in place, it takes a couple of hours usually before the applications are blocked. It also works the other way around, actually. So I've had situations where I've had a tagging policy that just unsanctions applications automatically based on some categories, for instance, or some other things I've set. If you block an application by accident and then remove the indicators, it can take a couple of hours, and your client might get angry about it. So be aware of the fact that also takes some time. Last but not least, which is really important, is this is limited to the cloud applications included in the cloud app catalog by Microsoft. So in Defender XDR, in Defender for Cloud Apps, you have a section called Cloud App Catalog, and that's all of the cloud apps that Microsoft has in their catalog. So you cannot block an application that's not in that catalog. It is limited to those applications. Most applications are there, but it is still limited. I've run into some situations where, yeah, that limitation unfortunately meant they didn't have the cloud application there.

Jazzy: A lot of this is in terms of what we're talking about with the tagging and the unsanctioned bit, where it does block and uses Defender for Endpoint to deploy the custom network indicator and all of that good stuff. But we do have conditional access app control, where it will work for unmanaged devices, where you pass the session over for that specific app into Defender for Cloud Apps using conditional access, which we'll show you in a bit. That can work on unmanaged devices, where it uses the built-in protection for Edge and it shows you the native URL, whereas for other browsers like Chrome it will use a reverse proxy basically, to define or govern what an access policy does and what a session policy does. Which again we'll show in a few minutes in the next few slides.

Jazzy: But we do have app connectors as well. So there are two things about this, right? You've discovered your apps and everything available. You're either managing with access policies or session policies, and you're doing certain things to let that user do what they want within that app. But what you can also do is you can connect some apps into Defender for Cloud Apps to find out what is currently configured in there. So we can have a look at all the users in there. We can have a look at the audit trail of the sign-ins. We can even use app governance and suspend a user or remove them from the OAuth token, from the app itself that's registered within Entra ID. And best of all, which I really think is amazing, is that some of these apps feed directly into Secure Score and actually show you some recommendations of what you can do inside that app. So for example, if you connect Box to it, I think Box is one of them or Dropbox is one of them, it tells you what could be configured better within the app directly in the admin portals, for a separate third party app, which I think is absolutely amazing. So imagine that: cloud discovery monitors all the traffic, it sees what people are using into the outside world, whereas with app connectors you bring it back in. So you look at the governance, you look at the settings configured, and it helps you increase the posture of that connected app, which I think we'll show in a couple of seconds on a different slide of what we have available.

So I think I overexplained on the previous one probably, but exactly that: SaaS posture helps grade your connected apps. It shows you what's available to fix. You can cover some apps within it. It gives you a lot of data in terms of making sure that apps that don't even live within Microsoft 365 directly are at a better state than they were before you connected it.

Redouan: And I'm guessing that the next natural question to ask is what applications are actually included in these app connectors, or what can you actually configure? Not every app connector is the same. So Jazzy discussed, for instance, SSPM, so that's the security posture management for those SaaS applications, doing the OAuth governance for it or user governance, for instance. Not every app connector is the same. So for instance Microsoft 365 and Google Workspace: everything is included. So if you do utilise it then of course you've got to connect it. Microsoft 365, always connect it, please. You also have an Azure one, also connect that as well. There's not really a good reason not to do that. But you can see that some of these app connectors are limited. So if you are utilising one of the applications on the right hand side here, that was a really shitty, there we go, if you do utilise one of those applications, you might want to think about connecting them into Defender for Cloud Apps so you get all of those possibilities that Jazzy just discussed.

Jazzy: Yeah. And especially with things like Box and Dropbox, considering their collaboration services and their old files that may be private to the company itself. We can also have things like Purview and file policies that are looking for labelling and auto labelling and data classification. Even though they're a connected app and the files live elsewhere, we can still use Microsoft to extend those capabilities.

Redouan: There's a really interesting question from Martine in the chat. He's asking: when rolling out Defender for Cloud Apps discovery, how do you handle the employee privacy side? Do you enable username and device anonymisation by default, and how do you communicate the monitoring to staff? So, interesting one. The way that we did it within our MSP, usually within one of the projects that we did when we configured Defender for Cloud Apps, we left anonymisation off so we actually had the visibility. We could actually discuss it with the IT manager or the CISO so they knew what was going on. So for the first couple of weeks, first couple of months maybe, we had that visibility and they could actually act upon it. But then after that we turned on the anonymisation, and then after that we could act upon it differently. But for the first couple of weeks definitely, we actually need that visibility. We need to know what everybody is doing. But this is really different for every MSP, right? It depends on what kind of relationship you have with your clients as well, and with the customers.

Jazzy: Exactly, right. So for us it was always be open and upfront about what we're trying to do and what we're trying to achieve with it. So if we were enabling any of these settings it would be defined in their IT policy, the internal IT policy for the customer side, and the employees sign that IT policy of what we are capable of and what we're not capable of, in terms of making sure that all of our boxes are covered and checked and we're not breaching any laws. Usually it would be a direct communication with the customer, whether or not they've signed something like that. Sometimes I feel like the internal IT policy that they've created is quite generic and it generally covers some of this using the clauses, because realistically, if someone installs an application, or we look at network logs in the firewall or in discovered apps, things like that, some of this stuff is already covered. But I would 100% say discuss it with the customer, your IT contact, and see if they already have something that covers it.

Redouan: "I think because you like this insight as a manager, but sometimes we forget this part." Do you mean the wrong way around, as in having that visibility at first and after that not? So I'm not getting the point that you're making. Ah, yes. Okay. Well, like Jazzy said, and me as well, basically do whatever works for you and your client. That's just the way that we did it within our MSP. One very similar example to this is within email and collaboration. Whenever you go to emails, you have a role that gives you access to the actual content of the email. That's also a very specific example: please discuss that with your client, because there are some clients that will tell you definitely no, we don't give you access to preview those emails, and some clients won't mind since you need it for your investigation. And I think I would dare to say that this is quite similar to that. So it depends on the client and their regulatory requirements as well.

Jazzy: Yeah, for us it was always discuss with the customer and then make sure that we're covering whatever they have decided upon within their own employees.

Redouan: Conditional access app control. So we did discuss some of the real time policies and real time functionalities that you have within Defender for Cloud Apps. This is what we're basically referring to. So you have two options here: you have access policies and session policies. The way that you should think about this, in the corner you can already read it, so let's say a user goes to SharePoint Online from an unmanaged home PC and they try to download something, they try to copy something, you can block those actions or you can monitor those actions. So this is actually a really strong control that you can configure. You do need to realise that it works together with conditional access. So you need to configure a conditional access policy. Within that conditional access policy you can already configure 99% of it if you go for the top two options. So that basically gives you the option to just configure it from within conditional access. You can also use a custom policy, and that means that you actually define the policy within Defender for Cloud Apps, and that's where you actually configure all of the different components of that specific policy. Access policy means basically outright blocking or allowing access to it. Also very important: this is for cloud applications. So this is not for desktop applications. So this won't block downloads from any desktop applications whatsoever, only cloud applications.

Jazzy: In a classic use case like that, you'd probably end up blocking them from using desktop apps when they're at home, like OneDrive and things like that, and allow only web access and use the session policy, whether that's custom or the block downloads one only, that is shown in that screenshot, for them to be able to control what someone can do on an unmanaged device. And coming back to bringing it all in house in terms of it being a Microsoft native stack, it's where you get to see whether or not the device is enrolled. Is it compliant? You have so many more controls you can do now that we have a tool like Defender for Cloud Apps living inside the same ecosystem where our Defender for Endpoint is deployed, where our compliance policies are, where our MDM policies are. So it's quite nice to have this all in one tool set.

Redouan: Yeah, exactly. Perfect. Let's see. OAuth apps. Also a very interesting one. And there we go.

Jazzy: You want to take it? Go for it.

Redouan: Okay. So I'd say the core message of OAuth apps and app governance within Defender for Cloud Apps is that it basically gives you visibility into the enterprise applications within Entra ID and the API permissions, but then in an actionable way, so you can actually do something with it. We've had a lot of issues getting visibility into all of the enterprise applications, but then also the API permissions, that's actually pretty hard to get visibility into. Whereas within Defender for Cloud Apps, with app governance, it's already baked into it and there's already a lot of logic there as well. You can turn it on really quickly. So it's just in the settings, Cloud Apps, go to App Governance and you can just enable it. It does take up to 10 hours, yeah, 10 hours before you can actually see it. But then it's actually presented in a way that you can do something with it, and you can actually also perform all the actions from within the app governance portal. So this is, I want to say, one of the most important things that you have within Defender for Cloud Apps, since it links back to Entra ID and you can actually do something actionable with those enterprise applications and API permissions. So I'm pretty sure that we have a little screenshot here as well. So you can see you get a dashboard of all the enterprise applications. Are any applications overprivileged? Are they not used at all? Are they highly privileged? And you can also see what users are actually using those applications, for instance. So we can see 16 unused applications already. So we can already ask the question, hey, do we need to revoke those API permissions or delete those enterprise applications altogether? And when it comes to risky apps, there's a very big chance you're going to see a random enterprise application that has API permissions that don't match, that shouldn't have those API permissions, because usually, or a lot of the time, enterprise applications will ask for consent for more API permissions than they actually need. So if we're talking control over enterprise applications, I would rather go to app governance within Defender for Cloud Apps than go to Entra ID. Would you add anything to that, Jazzy?

Jazzy: I think you explained it very well.

Redouan: Perfect. Perfect. So, policy engine. From within Defender for Cloud Apps you can configure multiple policies. You have some baked-in policies already that might be turned on or turned off. Go through the, I think it's called, let me see, policy templates, if I'm not mistaken. Yes, policy templates. Go through them. Turn on the policies that are there by default, but you also get a lot of control yourself. So we've already discussed the access policies and session policies. These were the policies that work with conditional access. App discovery policies are just a way of tagging applications automatically. So that can be the unsanctioned applications, for instance, so that's blocking applications if you've configured that correctly. Wow, I shouldn't have done this. I should not have done this. OAuth app policy, we've just discussed that in the previous slide. So you can create your own policies around that app governance. And file and activity policies, we've already discussed those as well in one of the previous slides. So you have that freedom yourself. You can actually configure policies and then also bind actions to those policies. So whenever a specific policy is alerted for some reason, you can then put in governance actions as well, depending on the applications you have connected. So for instance, Microsoft 365 is one of those applications that you can connect into Defender for Cloud Apps. If you do that, you get a lot of governance actions that you can actually bake into your own policy. So you have a lot of granularity and a lot of control over what you actually configure when it comes to the policies. Especially the app discovery policy with tagging, that's something that we always configured. So Defender for Cloud Apps has a risk score for every single cloud application. It's a risk score ranging from 1 to 10, one being very bad, 10 being very good. We usually always configure the app discovery policy that blocks all applications with a risk score from one to three. Before you actually configure that policy, you can hop to the cloud discovery page, so that's the dashboard with all of your cloud applications already discovered, and then just filter on those applications so you actually know what you're blocking, instead of blocking an application that is in use by the organisation. We will see if we have some time at the end of the webinar to do a little demo and actually show that.

Jazzy: Yeah, I really did like the app discovery policy, because it's a good way to find new apps that we haven't seen before or haven't necessarily looked at before. You can tag it with a custom tag and review at a later date when it does come time to it. You can get alerts on it when it does happen and something new is found and it matches the conditions that you apply to it and the filter, exactly like Red said. If it was a risk score of X, then let's get a look at that, right? It's a really good way to discover new apps, because it's hard to stay on top of what people are already using, let alone what new stuff they're going to be using.

Redouan: So I saw some questions that you already answered within the chat, people not being able to actually go through to the recordings on the website. I'm pretty sure it's a cookie thing, because I had the same issue. But in the bottom corner on the left, you can consent to cookies again. You need to consent to the marketing cookies. I think that is the issue, because I had the same issue actually. But I didn't even know they were on YouTube as well, but I think you already linked to it.

Jazzy: Yep. All done. Perfect. Unsanctioned on its own blocks nothing. Absolutely right, unless you have the MDE integration. So we're talking about things that sometimes we forget about, right? I mean, to me, unsanctioned in my brain says if I mark something as unsanctioned it should stop working across the board. It does really help in terms of knowing that without an MDE integration, so without the Defender for Endpoint integration, or a gateway sitting behind it, unsanctioned won't do anything, right? Because unsanctioned is the bit that sends off the Defender for Endpoint custom indicators to block you from accessing it. So you definitely need that. App governance doesn't get switched on automatically, you do have to enable it within the settings. Hopefully Red can show us that in a minute when he does do a lovely demo of the platform. I think we have some time left if we can get through the lovely PowerPoint slides that we all love. It's way more fun looking inside the tools. And a lot of predefined policies are alerting. So there are lots of out of the box policies that have been created by Microsoft and they're all already in there. If you'll notice, most of them either say disabled next to them or they're just alerting. Have a look at the templates that are in there. Have a look at the pre-existing policies. Enable the ones you need. Don't enable the ones you don't need. But there's so much stuff in there already that helped me out when I started off with Defender for Cloud Apps. I didn't have to think too much and too long about it. But my journey was quite helpful for seeing all those predefined policies that are already in there. And then I think lastly, let's maybe jump into the demo, right? Let's show certain things and maybe a checklist at the end of what we need to do.

Redouan: Let me just get everything up and running. Give me a quick minute and then we'll dive into it.

Jazzy: So this is where I should probably need to be filling the gap until Red is ready. Otherwise you just hear Red go the whole way through, filling in the blank noise here. But I'm sure you have it all up and running. There were some things that we discovered while creating the slide deck, because obviously when you're defining these decks, Red, you have to redo it yourself and live it all again. And as we were configuring certain things, like, oh yeah, this setting lives here, we forgot all about this setting. But that's the best part of doing these demos as well, is you end up remembering your own stuff that you did a gazillion years ago.

Redouan: Exactly. Can you see my screen?

Jazzy: Absolutely, sir.

Redouan: Perfect. Perfect. So right now I am on an unmanaged device for this tenant. So this is my inforcer device. I'm in a private browser. I just logged into a different tenant. So I'm on an unmanaged device. There is a certain document within that SharePoint library. If I try to download it, let's see if the demo gods are willing, guaranteed going to fail, right? Yeah. So you can see that the download is blocked. So this is one of those conditional access app control policies. This is a session policy, and the session policy defines that within SharePoint Online, if I'm on an unmanaged device, I am not able to download documents. So you can see that's actually blocked. And the only thing that is downloaded is actually a little document that just tells me again it's been blocked. There we go: file was blocked since it contained data that is not allowed to be downloaded. So this is an example of one of those session control policies. What I can also show is what happens if you unsanction an application within cloud discovery and it's actually blocked. So you do have the Defender for Endpoint integration in place, and what does it look like from the user's perspective if they try and go to a cloud application. I'll actually show that first in the portal, excuse me. So if we go to cloud discovery, I can see all of the applications that have been discovered within this tenant. If I hop over to discovered apps, I can filter on applications here in the top banner. If I filter on unsanctioned applications, I can actually see that I unsanctioned YouTube, for instance. So just unsanctioning this app doesn't mean anything. It just means that it's unsanctioned within Defender for Cloud Apps. How do you actually know that it's enforced? If you go to settings within Defender XDR and you hop over to endpoints, you have something called indicators, and Defender for Cloud Apps should have made some indicators. And you can see here that for a certain application, YouTube, there are a couple of indicators that have been made. And who made those indicators? If I hop over to the right, you can see that Defender for Cloud Apps has made those indicators. So yes, you can make them yourself, but if you unsanction, Defender for Cloud Apps will actually make them here in Defender for Endpoint. So if I now hop back to that cloud PC which is enrolled in this tenant and I try to go to YouTube.com, for instance, YouTube is blocked. If I try to do it from within my own browser it should also be blocked. So this is in Edge. So in Edge you can also see that YouTube is actually blocked. So this is an example of unsanctioning cloud applications, having the correct prerequisites met, and then from the user's perspective, what does it actually look like? So you can give users the control to actually bypass it, but by default it's just blocked and users cannot go there.

Jazzy: Just to add, there are some prerequisites as well to make sure that this stays disabled, like enable network block mode and other prerequisites for Defender for Endpoint policies that you have to deploy out. I don't remember all of them off the top of my head, but in order for this to work it is defined what you need to deploy out. So enable EDR in block mode, custom network indicators there, and some endpoint specific settings that you can push out through Intune and stuff as well. If I'm not wrong, it has to be the active AV and things like that.

Redouan: Yeah. Yeah. So there are some things within Intune or endpoint security policies that you need to configure, depending on where you configure them, in Intune or Defender for Endpoint. Network protection, for instance, is one of them, and there are a couple of others as well. Microsoft Learn is really granular about that. So it's really easy to configure. That can be configured in one policy, if I'm not mistaken. And there are some toggles here as well, just like Jazzy said: custom network indicators, block mode, and the Defender for Cloud Apps integration. Please don't forget the toggle from within Defender for Cloud Apps. So if you hop back to settings

Jazzy: The one that gets missed.

Redouan: Yeah, exactly. You can go to cloud apps, and within the cloud discovery page or section you have Defender for Endpoint, and there's a toggle here, enforce app access. So this is actually enforcing, or giving Defender for Cloud Apps the possibility to actually go back to Defender for Endpoint and tell it to make those indicators, or actually make the indicators within Defender for Endpoint. So yes, that is one that you shouldn't miss. So that is a way of unsanctioning cloud applications. But as you can see, if you go to your discovered apps, unsanctioning applications from within here is manual labour. So I'm not sure if you want to go ahead and do that. So like I said, what we usually did within our projects is make one of those policies. So if we hop to policy management on the left hand side, you can create a policy yourself and you can make that tagging of applications really easy. So, app discovery policy. If we create one, we can make a couple of filters. We can give it a name. So this could be block unsanctioned AI apps, for instance, since AI needs to be mentioned somewhere, anywhere nowadays.

Jazzy: How do you have a webinar without mentioning AI?

Redouan: Exactly. It took us way too long to mention AI. So I want to unsanction all of the AI applications that are not sanctioned already. So I can filter here by category. So if I hop over to categories, equals, and let's search for AI. So we have generative AI MCP service, and model providers. These bottom two are actually added just, if I'm not mistaken, a couple of weeks ago, a couple of months ago maybe.

Jazzy: I haven't even played with the AI MCP or model providers just yet.

Redouan: And then you just basically stack these on top of each other. So right now all of the AI applications are in scope, but I only want the AI applications that equal no value probably. So, does not equal sanctioned. So that means that all of the AI applications that are not sanctioned, we can give that a specific action. And one of those actions is tag app as unsanctioned. So you would first sanction the AI applications that you do want to use within that organisation. So for instance Copilot, and maybe Claude if they use Claude in that organisation, or ChatGPT, depending on the organisation of course. And after that you can make this policy and then Defender for Cloud Apps just unsanctions those applications automatically and you don't have to think about it yourself. There is one more thing that I want to show here though when it comes to creating policies, and that is the activity policy and the governance action. So I will not dive into the actual activities and all the different filters that you can put here, but if you scroll down to the bottom you can see governance actions, Microsoft 365. The reason why you can actually link actions to this specific alert is because you connected Microsoft 365 using one of those app connectors. So if you connect different applications and it is supported, you can actually have multiple actions within different platforms or different applications that you connected within Defender for Cloud Apps. So it's not just alerting, you can actually automate it to also have a certain action in place, if that makes sense. Now that we're talking about connecting applications anyway, let me show you real quickly where you do that. So it's in settings, cloud apps. If you scroll down a bit, I think it's literally called app connectors. So there we go, app connectors. And you can see that Microsoft 365 and Azure are already connected within my environment. And this is also where you would connect one of those other applications. To be honest, as an MSP you probably won't use this very often since it's really an enterprise thing. Within our MSP, I think I've configured this once or twice: one time for GitHub and one time for Dropbox. But that's it, basically.

Jazzy: We do have a question, and probably a perfect place for you to be in. Is the OAuth apps discovery automatic, or does it also require settings to report back to the portal? So it might be worth showing the app governance section here as well, where you can enable that.

Redouan: Oh yeah. So, when it comes to app governance, on the bottom of the page, app governance service status, you have a little toggle here, turn on app governance when it becomes available. You can submit, but this does take about 10 hours, and I just did it a couple of hours ago in this tenant, so unfortunately on the left hand side here I cannot show you app governance as of yet. OAuth apps does have some overlap with it though. So OAuth apps is, I want to say, the little brother of app governance. It basically just shows you the enterprise applications that are in place in the tenant. I just put in some enterprise applications and you can see the permission levels. As you can see, this is already more than Entra ID shows you in the overview, but then app governance shows you even more and way more actionable things. Anything in the checklist that I'm missing right now that we had in the checklist? Maybe some other things that we can look at.

Jazzy: Some of the predefined policies that we have, which are exactly in the right place. If you can go to policy management as well, there are lots of predefined policies in there that usually say disabled next to them.

Redouan: Yeah. So only a couple of them are active by default. So please go through these policies. That's also what we usually did within our projects. We went to the customer and basically told them, hey, these policies, we want to turn them on, and let the customer decide if that's something that they also agree with. This was for organisations that were a bit bigger. They had internal IT. They had their own CISO. So they did have to say something about it. But for smaller clients, you might want to just enable the things that you see fit for that organisation. So these are the template ones that you can enable. So you don't have to figure out what policies to configure and then enable yourself. You can actually use the templates provided.

Jazzy: Should we show where the tick box is for the conditional access policy, for having the session being delivered to Defender for Cloud Apps?

Redouan: Actually I think I do have one policy in place already, so I can show that real quick. Let's hop over to conditional access. So I made a real quick demo policy. Search for that. There we go, demo Office 365. Click on edit real quick. So you define the users that it applies to. You can have specific resources applied to it. A lot of the time it's just the cloud applications within Office 365. And then under session controls you have use conditional access app control, and this is where you can monitor only, block the download. So this is what I actually configured in order to block those downloads in SharePoint that I just showed. And when you go for use custom policy, the policy is defined within Defender for Cloud Apps. So if I hop back to Defender for Cloud Apps and I create a policy, I could create a session policy from within here, and then this session policy actually applies to that specific session of those users, if that makes sense.

Jazzy: Yeah. And then I think lastly is making sure you've got all the licenses to get all of this to work, where we can see some of the licensing stack.

Redouan: Definitely. Let's see if I can hop back to the slide deck. Let's see. We have the checklist over here. Present. Any questions? Please feel free to put them in the chat, because we have about 5 minutes left. We are moving towards the end. Let's see. We have the checklist at the very end. See where it is. There we go. Can you see that as well, Jazzy? The checklist.

Jazzy: Yeah, all good.

Redouan: Yeah, perfect. So we've discussed some things in the checklist. We might have skipped over a couple of these things. Please let us know or give us some feedback if you want to have a webinar about one of the other components within Defender. I'd really love to hear that. Maybe one of the components within Entra ID. Don't forget that the next webinar that is scheduled is about Defender for Endpoint. That's something that a lot of organisations might not use, or might not fully use, or they have some third party AV in place for some reason, or for some legacy reason maybe, because a lot of the time MSPs don't realise how far Defender for Endpoint has come in the last couple of years. So yeah, I'd love to hear the feedback. Do you have any closing words, Jazzy? Anything that I left out?

Jazzy: Thank you for sticking by us, that's probably the best thing I can say. We absolutely do enjoy having you guys here and sharing our knowledge of what we've done so far and our ability to keep it inside the Microsoft ecosystem. And we would love for you to continue using Microsoft the way you do. Ultimately, if there are any people here that don't make use of inforcer yet, please do. We absolutely can deploy conditional access policies using inforcer to help you with those cloud app controls. We can help. We have things like TDR now as well that can help you secure your environment even further. And we'd love for you to partner up with us if we already haven't.

Redouan: So we do have a question in the Q&A which is quite interesting. So Dominic asks, how do you differentiate between the different Defender products? So for example, when do you block access to websites with Cloud Apps and when with Defender for Endpoint web filters? So I'm guessing you're pointing to the web content filtering policy. There are so many products that can do the same. So yes, you are definitely right. You can have the same outcome with different products. So within Intune you can configure some policies as well to block domains. Within Defender for Endpoint you can put in custom indicators yourself, or you can do it within Defender for Cloud Apps.

Jazzy: I would say content filtering ultimately ends up being categorisations, right, rather than being very specific and granular as to what you're deploying, what you're blocking and also discovering. You're doing a lot of that manually. Defender for Cloud Apps helps you discover and deploy custom indicators with ease. You could probably do that yourself, it just requires a lot of manual activity.

Redouan: Yeah, definitely. And please don't forget that when it comes to web content filtering and Defender for Cloud Apps, Defender for Cloud Apps is really about cloud applications that could be sanctioned. These are good cloud applications that are probably in use for good reasons. Whereas web content filtering is usually to block explicit content, to block gambling, to block illegal software and stuff like that. So I'll give you one example, Dominic. Within Defender for Cloud Apps I cannot block free proxies, something that is utilised a lot within some organisations. You do want to block that, and we lost some visibility over cloud applications since users were using proxies. So within web content filtering, that is where you can block those illegal routes that people take, so illegal or explicit content, for instance. And to be honest, they live perfectly with each other, so you would actually configure them both. So we configure the web content filtering by default with just Defender for Endpoint. You can configure it already. And then with Defender for Cloud Apps that's a little bit of a step up, since it's not just about blocking, it's about those session policies, getting those secure score recommendations in. So web content filtering is just blocking based on categories, whereas Defender for Cloud Apps is way more, I want to say, intricate or way more complex, and you have more control over what you can configure there.

Jazzy: Absolutely. I hope that answers the question. We also have a question from Seabir here as well: which three checklist items would I prioritise in a brand new M365 tenant?

Redouan: Oh, good question. So definitely, licensing would be number one.

Jazzy: Yeah, licensing.

Redouan: If you don't have the license, you're not going to come very far. No, I would say turn on cloud discovery is definitely number one for me, because that's where it all starts when it comes to Defender for Cloud Apps, right? It all starts with that discovery, and from the discovery you actually build upon it. But Jazzy is going to interrupt me.

Jazzy: I mean, no, I completely agree with you. But then there's a prerequisite there, right? If you're turning cloud discovery on for the Defender for Endpoint route, you need Defender.

Redouan: There we go. Okay. So actually, Defender for Endpoint: you need to actually have Defender for Endpoint rolled out with the right prerequisites, and after that, yeah, turn on cloud discovery and turn on that integration. So now we have two of them. I would say the third, oh, okay, that's interesting, the third one. I'm thinking about doing the app discovery policy first, or actually connecting in Microsoft 365 since that's really important as well. What would you say?

Jazzy: Yeah, I would probably go with confirm licensing, deploy Defender for Endpoint, even though that's not in that list, let's call that step 1.5, turn on cloud discovery and write the app discovery policies. That's probably what I would do. I would do everything that I already discover and not manage whatsoever, just in the beginning.

Redouan: Yeah, fair enough. Fair enough. Very good point. Very good point. Well, everybody, thank you so much for sticking by. We will see you hopefully on the next webinar. I think it's in two weeks.

Jazzy: Like you said, Defender for Endpoint. So thank you very much for listening in and staying with us for the questions as well. Cheers everyone.