Topic 7 of 8
Defender for Cloud Apps and Defender for Identity
Employees use hundreds of SaaS apps, many without IT knowing, and most companies still run an on-premises Active Directory that attackers love. Defender for Cloud Apps watches cloud apps and Defender for Identity watches on-premises AD. The exam keeps testing that you don't confuse them with each other or with Entra ID Protection.
Contents
Defender for Cloud Apps
It's a comprehensive SaaS solution that provides visibility and control over cloud applications. It combines several capabilities:
CASB
Cloud access security broker: an intermediary between users and cloud apps that enforces the organization's security policies.
SSPM
SaaS security posture management: configuration recommendations based on the CIS benchmark for connected apps, reflected in Microsoft Secure Score.
Advanced threat protection
Adaptive access control and user and entity behavior analytics (UEBA) to detect anomalous activity.
App-to-app protection
App governance for OAuth apps and AI agent protection.
In the Defender portal it has its own Cloud apps node: Cloud Discovery, app catalog, app governance, activity and governance logs, and policies.
The Cloud Apps framework
Discover and control shadow IT: Identify the apps in use, their risk, and who uses them, and decide which ones are allowed.
Protect sensitive information: Find, classify, and protect sensitive data inside apps, with labels and DLP.
Protect against cyberthreats and anomalies: Detect unusual behavior, compromised accounts, and malware in cloud apps.
Assess app compliance: Check whether apps meet regulations and industry standards.
How it connects to apps
| Method | How it works | What for |
|---|---|---|
| Traffic analysis | Firewall and proxy logs, or signals from Defender for Endpoint | Discover which apps are used (Cloud Discovery) |
| API connectors | Direct connection to the app's API (Microsoft 365, Google Workspace, Salesforce…) | See activity, files, and configuration; apply governance actions |
| Session control | Conditional Access App Control: the browser session goes through Cloud Apps (reverse proxy; in Edge, in-browser protection) | Real-time control: block downloads, copy, or paste |
Discovering shadow IT
Shadow IT is the apps employees use without approval: a file-sharing service, an online PDF editor, an AI tool. Each one can be a data leak. Cloud Apps follows three steps:
1. Identify
Analyzes traffic and compares it with Microsoft's cloud app catalog.
2. Assess
Each app has a risk score based on more than 90 factors: security, compliance (SOC 2, GDPR…), and legal aspects.
3. Manage
Mark apps as sanctioned or unsanctioned and create policies that alert on risky usage.
Protecting data and detecting threats
- Information protection: applies sensitivity labels, blocks downloads to unmanaged devices, and removes external collaborators from sensitive files. It integrates with Microsoft Purview DLP.
- Anomaly detection: impossible travel, activity from an infrequent country, unusual mass downloads or deletions, multiple failed sign-ins.
- Policies: activity, anomaly detection, access, session, app discovery, and file policies, plus built-in policies for OAuth apps and malware. File policies retire on January 6, 2027, and are migrated to Purview DLP or auto-labeling.
App governance and AI agents
Many apps aren't used by a person but by another app: an integration that reads email via OAuth, for example. App governance monitors OAuth apps registered in Microsoft Entra ID, Google, and Salesforce: what permissions they have, what data they access, and whether they behave anomalously.
Cloud Apps also offers AI agent protection for agents built with Copilot Studio, to detect and block risky activity by those agents.
Defender for Identity
An identity security solution (ITDR, identity threat detection and response) that uses signals from on-premises Active Directory, Entra ID, and other identity systems such as Okta to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions.
How it works
It installs sensors on domain controllers, AD FS servers, and AD CS servers. The sensors analyze traffic and events locally and send only the parsed information to the cloud.
Prevent, detect, investigate, respond
Prevent
Identity posture assessments (shown in Secure Score) and lateral movement paths: they show how an attacker could jump from a regular account to a sensitive one.
Detect
Alerts along the attack chain: reconnaissance, compromised credentials, lateral movement, and domain dominance.
Investigate
Attack timeline and context for each alert in the Defender portal, correlated with the rest of the suite.
Respond
Actions on the account in AD: disable the user or force a password reset.
| Attack phase | Examples it detects |
|---|---|
| Reconnaissance | Enumeration of users, groups, and computers; suspicious LDAP or DNS queries |
| Compromised credentials | Brute force, Kerberoasting, anomalous sign-ins |
| Lateral movement | Pass-the-hash, pass-the-ticket |
| Domain dominance | Golden ticket, DCSync, malicious replication |
In the portal, the Identities node groups the dashboard, sensor health issues, and tools.
Defender for Identity vs. ID Protection
| Defender for Identity | Entra ID Protection | Defender for Cloud Apps | |
|---|---|---|---|
| Protects | Identities, especially on-premises AD | Entra ID sign-ins | SaaS app usage |
| Signal | Sensors on domain controllers | User risk and sign-in risk | Traffic, API, and proxy |
| Example | Pass-the-ticket | Leaked credentials, anonymous IP | Mass download in Box |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Find out which cloud apps employees use without IT approval | Cloud Discovery (Cloud Apps) | It analyzes traffic and compares it with the catalog. |
| Assess whether a SaaS app meets SOC 2 or GDPR before approving it | Cloud app catalog | More than 90 risk factors per app. |
| Block downloads from unmanaged devices in real time | Session control (reverse proxy) | Conditional Access App Control. |
| Detect an OAuth app with excessive permissions on email | App governance | It monitors OAuth apps registered in Entra, Google, and Salesforce. |
| Detect a pass-the-hash attack against on-premises Active Directory | Defender for Identity | Sensors on the domain controllers. |
| See which sensitive accounts an attacker could reach from a regular user | Lateral movement paths | Defender for Identity. |
| Block a cloud sign-in from an anonymous IP | Entra ID Protection + Conditional Access | Cloud sign-in risk, not on-premises AD. |
| Check whether a SaaS app's configuration follows best practices | SSPM (Cloud Apps) | CIS-based recommendations that feed Secure Score. |
Common exam traps
❓ What is a CASB?
An intermediary between users and cloud apps that enforces security policies. Defender for Cloud Apps is Microsoft's CASB.
❓ Does Defender for Identity protect cloud sign-ins?
Its strength is on-premises Active Directory, though it also uses Entra ID signals. The risk of Entra ID sign-ins is assessed by Entra ID Protection.
❓ Where are Defender for Identity sensors installed?
On domain controllers and on AD FS and AD CS servers.
❓ Do the sensors send all traffic to the cloud?
No. They analyze locally and send only the parsed information.
❓ Which component blocks, in real time, a file download from an unmanaged device?
Cloud Apps session control (Conditional Access App Control, a reverse proxy).
❓ Does app governance monitor users?
No. It monitors OAuth apps: their permissions, data access, and behavior.
❓ What do lateral movement paths show?
How an attacker could jump from a non-sensitive account to a privileged one. They belong to Defender for Identity.
Did you get this topic?
Test what you just learned
The security team finds that employees upload files to an unapproved cloud storage service. They want to see every app in use and its risk level. What do they use?
Ready to test "Defender for Cloud Apps and Defender for Identity"?
Original questions, each with a full explanation.
Start a mock exam