3.2MS-102Advanced
Est: ~15 mins•Verified: 2026-08
Defender for Cloud Apps: Shadow IT & Session Control
Discover unapproved cloud SaaS applications, sanction/unsanction cloud services, and implement real-time Conditional Access App Control session policies.
Tags:#Defender for Cloud Apps#CASB#Shadow IT#Session Control#Security#MS-102
01
Overview
Microsoft Defender for Cloud Apps (MDA) is an enterprise Cloud Access Security Broker (CASB) providing multi-layered protection across SaaS, PaaS, and IaaS environments:
- Cloud Discovery & Shadow IT: Analyzes network firewalls and Microsoft Defender for Endpoint telemetry to catalog all cloud applications in use, evaluating over 31,000 SaaS apps across 90+ security risk factors.
- Sanctioning & Unsanctioning: Allows administrators to mark apps as Sanctioned (approved), Unsanctioned (blocked on all Defender-managed endpoints), or Monitored.
- Conditional Access App Control (Reverse Proxy): Intercepts user browser sessions in real-time to prevent unmanaged downloads, block copy/paste, and encrypt files upon export.
---
02
When to Use
| Capability | Target Scenario | Security Outcome |
|---|---|---|
| Shadow IT Discovery | Discover unapproved cloud storage (Dropbox, Mega, WeTransfer) | Flags data exfiltration risks and quantifies upload volumes. |
| App Unsanctioning | Block risky third-party AI or file sharing tools | MDE blocks access at network packet level on all Windows/macOS devices. |
| Real-time Session Policy | Contractor accessing corporate SharePoint from personal PC | Blocks file downloads; permits view-only browser editing. |
---
03
Prerequisites
Licensing:
- Microsoft 365 E5, Microsoft 365 E5 Security, or Defender for Cloud Apps standalone license.
- Integration with Microsoft Defender for Endpoint enabled for seamless endpoint discovery.
---
04
Portal Path
TEXT
Microsoft Defender XDR Portal (https://security.microsoft.com)
└── Cloud apps
├── Cloud discovery (Dashboard & discovered app inventory)
├── Discovered apps (Tag as Sanctioned, Unsanctioned)
└── Policies
└── Policy management (Create Activity, File, and Session policies)---
05
Step-by-Step Implementation
Step 1: Discover & Unsanction a Risky SaaS App
- Open Microsoft Defender XDR Portal (
security.microsoft.com) > Cloud apps > Cloud discovery. - Select Discovered apps tab.
- Review apps sorted by Traffic and Risk score (e.g., untrusted file sharing app).
- Click the three dots next to the app > Select Tag as unsanctioned.
- Microsoft Defender for Endpoint automatically syncs the block indicator, rendering the domain inaccessible to corporate endpoints within 15–30 minutes.
Step 2: Implement Real-Time Download Blocking (Session Policy)
- Go to Entra Admin Center > Protection > Conditional Access.
- Create policy targeting
Office 365 Exchange Online / SharePoint Online. - Under Session, select Use Conditional Access App Control > Choose Block downloads (or Use custom policy).
- In Defender portal > Policies > Policy management > Create Session policy:
- Filter: Device:
Is not Compliant - Activity type:
File download - Action:
Block> Custom message: "Download blocked on unmanaged device. Please view in browser."
---
06
PowerShell Automation
Inspect Defender for Cloud Apps Integration via Defender:
PowerShell
Connect-MgGraph -Scopes "SecurityEvents.Read.All"
# List cloud app risk alerts
Get-MgSecurityAlert_v2 -Filter "serviceSource eq 'microsoftDefenderForCloudApps'" -Top 5 |
Select-Object id, title, severity, status---
07
Microsoft Graph Automation
Query Cloud App Discovery Metadata:
PowerShell
Connect-MgGraph -Scopes "CloudAppDiscovery.Read.All"
# Query discovered cloud apps summary
Get-MgSecurityCloudAppDiscoveryReport -All |
Select-Object appName, totalBytes, userCount, riskScore---
08
Verification Checklist
VERIFICATION CHECKLIST
0/4 (0%)
Cloud Discovery dashboard reflects continuous traffic from Microsoft Defender for Endpoint.
Tagging an app as Unsanctioned renders the URL blocked in web browsers on managed PCs.
Accessing corporate SharePoint from an unmanaged PC routes the URL through *.mcas.ms proxy.
Attempting to download a document from the session triggers the custom blocked notification.
09
Diagnostic Logs & Channels
| Resource | Path | Purpose |
|---|---|---|
| Activity Log | Cloud apps > Activity log | Real-time audit trail of all cloud actions, file shares, downloads, and admin changes. |
| App Governance | Cloud apps > App governance | Monitors OAuth application permissions, overprivileged app registrations, and anomalies. |
---
10
Troubleshooting Matrix
| Error Code / Symptom | Root Cause | Exact Resolution |
|---|---|---|
| Session policy not intercepting traffic | User did not match Conditional Access policy routing traffic to Defender for Cloud Apps. | Verify Conditional Access session control setting is set to Use Conditional Access App Control. |
| Unsanctioned app not blocked on endpoint | MDE integration with Defender for Cloud Apps is toggled off in settings. | Go to Defender settings > Endpoints > Advanced features > Ensure Microsoft Defender for Cloud Apps is On. |
---
11
Production Best Practices
Production Best Practice
Use Reverse Proxy for Unmanaged BYOD:
Use Conditional Access App Control session policies to allow BYOD contractors to view and edit corporate documents in Office on the Web, while strictly preventing them from downloading local copies onto their personal computers.
---
12
MS-102 Exam Notes
Exam Blueprint & High-Yield Traps
High-Frequency Exam Objectives & Traps:
- URL Suffix: When traffic is proxied by Conditional Access App Control, the URL is appended with
.mcas.ms(e.g.,contoso.sharepoint.com.mcas.ms). - Discovery Source: Defender for Endpoint sends endpoint network logs to Defender for Cloud Apps without needing on-prem log forwarders.
---
13