Alerts from actions in apps that are not connected

Question

What type of policy template should we use if we want to get notified when someone tries to upload a file to an app that is not one of the "Connected" apps? I was thinking that I should use and Activity Policy, but I'm having difficulty configuring the filters. If I choose App equals, then the only choices are for apps that have already been connected.&nbsp;

jaredpoeppelman · Answer

Defender for Cloud Apps does not have any visibility into what is happening in the app unless it is connected via App Connector or via CAAC.  There is no general forward proxy in Defender for Cloud Apps to watch all activity to any app.  Instead, it is focused on protecting your sanctioned SaaS apps.

dean_gross · Answer

Thanks, what is CAAC?

jaredpoeppelman · Answer

Conditional Access App Control, a feature of MDCA.

Sorry, I generally presume if you are posting a question to the forum, you have already reviewed the extensive product documentation.

https://docs.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad

dean_gross · Answer

I have read those docs and that acronym does not show up on the page. Keeping up with the alphabet soup of old and new products is quite a challenge. I don't recall seeing that FLA in the past 5 years of using MS security products.

Forum Discussion

Alerts from actions in apps that are not connected

Share

Resources