Skip to content
← Back to the guide

Microsoft Defender for Cloud Apps explained

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

Microsoft Defender for Cloud Apps explained

Defender for Cloud Apps is Microsoft's CASB — discovering, monitoring, and controlling SaaS app usage.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

What is Defender for Cloud Apps?

Microsoft's cloud access security broker: discovers shadow IT from firewall and Defender for Endpoint logs, connects to sanctioned SaaS apps by API to govern data and activities, applies Conditional Access App Control s…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

How is Defender for Cloud Apps different from Purview DLP?

Purview DLP inspects and enforces inside Microsoft 365 and on endpoints; Defender for Cloud Apps extends similar policies to third-party SaaS via API connectors and to browser sessions via session control. They share se…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Is Defender for Cloud Apps included in E5?

Yes, in Microsoft 365 E5 and E5 Security, and in EMS E5. Cloud app discovery alone is included with Defender for Endpoint P2.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

You have E5 and 20+ SaaS apps outside M365

Verdict: Yes — connect the top ten by API and turn on cloud discovery.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

You have E5 but almost everything runs inside M365

Verdict: SSPM for Microsoft 365 and OAuth app governance are still worth turning on; skip Conditional Access App Control.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

You are on E3 and cannot buy Defender for Cloud Apps standalone

Verdict: Get cloud discovery via Defender for Endpoint P2 and lean on Purview DLP for the rest; MDA-lite by another name.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

You use a third-party CASB (Netskope, Zscaler) already

Verdict: Do not run both as the primary CASB. Use MDA for its native M365 signal (OAuth apps, SSPM for M365) and let the third-party CASB own the reverse proxy.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained

Slide 8Download PNG

Auto-generated from Microsoft Defender for Cloud Apps explained. This page is not indexed and isn't part of the guide itself.