Plans for multi instance app connectors to Office 365 and/or Azure?

[jensandersson]

Hi! Anyone know if there are any plans for multi-instance support for Office 365 and Azure app connectors?
I have a customer which have lots of tenants and they would like to aggregate all the security logging into the same centralized MCAS solution. But since it doesn't seem to be possible today they are pulling all the logs down on-premises for further analysis in their own SIEM.

I can really see the need for this functionality since many organisations buy other companies and end up with more tenants. If they are going to be able to keep control over the ever increasing security boundary they are forced to download all the logs to their local SIEM.

Thanks in advance!

[#2]

Hi @jensandersson,

AFAIK, there are no plans for multi-tenant support for Office 365 and Azure App connectors.

Would recommend raising this on the Cloud App Security Uservoice

https://microsoftsecurity.uservoice.com/forums/905161-cloud-app-security

I think it would be a good idea to potentially look at a version which could support multiple tenants - it would be good for Managed Service Providers, Groups, Franchises, etc.

At present, the local SIEM would be the only option to take the logs from the different tenants.

Hope that answers your question.

Best, Chris

[#3]

Hi @jensandersson,

As Christopher mentioned there are currently no plans for multi-instance support for 1st party apps.

To support multiple Office/ Azure instances you would need multiple MCAS tenants.

From there you have the option of of either using SIEM to centralize everything or by assigning admins from a single tenant with permissions to all others and then sue the tenant switcher to move through them. More info on this can be found here: https://docs.microsoft.com/en-us/cloud-app-security/manage-admins#invite-external-admins

Regards,

Dima.