3.2.3. Cloud App Risks and Microsoft Purview Alerts
💡 First Principle: Once an attacker holds a valid session, they use apps the way the user would, so the threats show up as unusual behavior rather than malware: mass downloads, new forwarding rules, an OAuth app suddenly reading every mailbox, sensitive files copied to USB. Defender for Cloud Apps watches app behavior; Microsoft Purview watches what happens to sensitive data. Both feed alerts into Defender XDR incidents.
Defender for Cloud Apps (MDCA) raises alerts from activity policies and anomaly detection across connected apps (Microsoft 365 and third-party SaaS through app connectors). Common alerts include impossible travel, activity from infrequent countries, mass download, ransomware-like file activity, suspicious inbox manipulation and suspicious forwarding rules, and unusual administrative activity. Investigation uses the activity log and the user's activity across apps; CloudAppEvents in advanced hunting carries the same data. Governance actions contain the account inside the app: suspend user, require user to sign in again (forcing reauthentication), and confirm user compromised. For apps, app governance detects risky OAuth behavior (excessive permissions, unusual Graph usage, data access spikes) and lets you disable or ban an app, revoking its consent so its tokens stop working.
Microsoft Purview alerts arrive in Defender XDR from two main solutions:
- Data loss prevention (DLP) alerts fire when policies detect sensitive information leaving through email, Teams, SharePoint, OneDrive, endpoints (copy to USB, upload to a personal cloud), and other locations. In an incident they show the user, the content's sensitivity, the policy matched, and the action taken (audit, block, block with override).
- Insider Risk Management alerts score sequences of risky user activity (for example, a departing employee downloading and exfiltrating data). Sharing these alerts into Defender XDR lets the SOC correlate them with external attack signals, while access to user details stays governed by Purview's role-based permissions and pseudonymization.
The SOC's role with Purview alerts is to decide whether the activity reflects a compromised account (an attacker using the user's identity, a security incident) or insider behavior (a policy and HR matter), then contain or hand off. The same data-movement alert means very different things in the two cases, which is why correlation with sign-in risk, MDI, and endpoint alerts matters.
⚠️ Exam Trap: "A malicious OAuth app with Mail.Read application permission keeps reading mailboxes after the user's password was reset" requires action on the app (disable or ban it in MDCA app governance, or revoke its consent and delete its service principal), because app tokens are independent of the user's password.
Reflection Question: A DLP alert shows a user uploading 500 confidential files to a personal cloud drive at 3 AM from a new country. What evidence would distinguish an external attacker using the account from a malicious insider, and how would your response differ?
