Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Defender for cloud App Security is not enabled but sending alerts to Defender 365

Copper Contributor

Hello,

This morning, we received alerts in Defender 365 for impossible travel from Defender for Cloud App security even though it is not enabled. We have attempted to investigate how this happened, but Defender for Cloud app security requests that we enable it before doing anything. We have never had it enabled before.

any ideas on troubleshooting how this service started sending alerts?

3 Replies
Can you please verify that nobody turned on the integration in the portal?
Defender for Cloud Apps, select the Settings icon, select Settings, and then select Microsoft Defender for Endpoint. Under Alerts, select the global severity level for alerts.
and on the MDE side:
Settings, Endpoints, Advanced features
https://docs.microsoft.com/en-us/defender-cloud-apps/mde-integration#how-to-integrate-microsoft-defe...
thank you for the reply Heike, it turns out someone in my org did enable Defender for Cloud Apps then quickly disabled, we went ahead and enabled the service completely.
Perfect! Glad you found the issue and it's now working!! Whoo-whoo! :)