MicrosoftDATP Team,
I have a question regarding the MCAS integration. Is this feature only supplementing the data that CAS is receiving from an on-premises log collector receiving traffic logs from a security appliance, or is this data going to act as a data feed on it's own? I ask because I have enabled the feature in DATP approx 24 hours ago, and still do not see the options laid out in:
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config
We aren't using the on-prem log collector functionality of MCAS, but the link below indicates that this integration with WDATP solves this issue:
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration
Any thoughts on why our MCAS portal doesn't seem to match up with the new advertised capabilities?
Thanks,
Ricky
MicrosoftHi,
To enable the MCAS integration you need the following:
1) EMS E5
2) RS5 endpoint (The integration is enabled for RS5 and above)
3) Turn on the integration switch in the WDATP settings.
Thanks,
Dan
