Defender for Cloud Apps: what you may already have
Microsoft Defender for Cloud Apps
per user per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
Microsoft Defender for Cloud Apps is Microsoft's cloud access security broker. It discovers the SaaS applications actually in use, scores them against risk factors, governs OAuth application permissions, detects anomalous behaviour, and applies real-time access and session policies through Conditional Access App Control. Two things to check before buying it. A subset called Cloud App Discovery already comes at no extra cost with Microsoft Entra ID P1, Enterprise Mobility plus Security E3 and Microsoft 365 E3, and it covers the same catalogue of discovered applications. And file policies retire on 6 January 2027, with Microsoft directing customers to Microsoft Purview instead.
What it is
Microsoft Defender for Cloud Apps is a cloud access security broker. It answers which cloud applications your people are using, which of those you never approved, what permissions those applications hold over your data, and what to do about it.
Who it is for
Organisations that suspect their SaaS estate is wider than their contract list, and organisations that need to control what happens inside a session rather than only whether the sign-in was allowed.
Key capabilities
- Cloud app discovery across a catalogue of tens of thousands of applications, from log upload or native Defender for Endpoint integration
- Risk assessment of discovered applications against dozens of risk factors
- App governance over OAuth permissions, including detecting overprivileged applications and revoking access
- Anomaly detection and user and entity behaviour analytics
- Access policies, which allow or block sign-in, and session policies, which allow the session while controlling what happens in it
- Integration with Microsoft Entra ID, Microsoft Intune, Microsoft Defender for Endpoint and Microsoft Purview
Check this first: you may already have the discovery half
Cloud App Discovery is a subset of this product and comes at no additional cost with Microsoft Entra ID P1, Enterprise Mobility plus Security E3 and Microsoft 365 E3. It covers the same catalogue of discovered applications, the same risk assessment and the same usage analytics. What it does not include is anomaly detection on discovered applications, OAuth permission revocation, data loss prevention, policy enforcement and the session controls. If discovery alone is the requirement, check what your identity licence already gives you.
A dated change worth planning around
File policies retire on 6 January 2027. Microsoft's guidance is to migrate them to Microsoft Purview data loss prevention or auto-labelling policies. If a deployment plan is being written now, write it against Purview rather than against file policies.
What Office 365 Cloud App Security is
A smaller subset that supports only the Office 365 application connector. It has the features but not the reach.
Do I already have part of this?
Probably. Cloud App Discovery is a subset of Defender for Cloud Apps and comes at no additional cost with Microsoft Entra ID P1, Enterprise Mobility plus Security E3 and Microsoft 365 E3. It gives the same application catalogue, risk assessment and usage analytics.
What does the full product add over Cloud App Discovery?
Anomaly detection on discovered applications, OAuth permission review and revocation, data loss prevention across SaaS, policy setting and enforcement, session controls, the SIEM connector and Microsoft Purview integration.
Are file policies still the right thing to build on?
No. File policies retire on 6 January 2027, and Microsoft directs customers to migrate them to Microsoft Purview data loss prevention or auto-labelling policies. New work should target Purview.
What is the difference between an access policy and a session policy?
An access policy allows or blocks the sign-in outright. A session policy allows access and then controls what happens inside the session, for example blocking downloads of sensitive files or requiring step-up authentication for a specific activity.
How is it different from Office 365 Cloud App Security?
Office 365 Cloud App Security is a subset that supports only the Office 365 application connector. Defender for Cloud Apps covers cross-SaaS applications, and adds cloud platform security posture for Azure, AWS and Google Cloud.
- Vendor
- Microsoft
- Category
- Security
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- SKU
- MST-NCE-DCA-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.