4.4.4. Microsoft Defender for Cloud Apps
💡 First Principle: Employees adopt SaaS applications constantly, often without IT's knowledge ("shadow IT"), so Defender for Cloud Apps acts as a cloud access security broker (CASB) — discovering which cloud apps are actually in use across the organization, assessing their risk, and enforcing policies (like blocking risky apps or restricting downloads) on sanctioned ones.
Discovery works by analyzing network traffic logs to surface every SaaS application employees are actually connecting to — frequently revealing far more applications in use than IT officially sanctioned — after which policies can be applied to control data flow into and out of those apps.
⚠️ Exam Trap: "Shadow IT" refers to unsanctioned application use by employees, not a synonym for malware — Defender for Cloud Apps' discovery capability is specifically aimed at visibility into this unsanctioned usage.
Reflection Question: Why might an organization discover, after deploying Defender for Cloud Apps, that employees are using far more cloud applications than IT had officially approved?
