Defender for cloud App Security is not enabled but sending alerts to Defender 365

[boatman51]

Hello,

This morning, we received alerts in Defender 365 for impossible travel from Defender for Cloud App security even though it is not enabled. We have attempted to investigate how this happened, but Defender for Cloud app security requests that we enable it before doing anything. We have never had it enabled before.

any ideas on troubleshooting how this service started sending alerts?

[#2]

Can you please verify that nobody turned on the integration in the portal?
Defender for Cloud Apps, select the Settings icon, select Settings, and then select Microsoft Defender for Endpoint. Under Alerts, select the global severity level for alerts.
and on the MDE side:
Settings, Endpoints, Advanced features
https://docs.microsoft.com/en-us/defender-cloud-apps/mde-integration#how-to-integrate-microsoft-defe...

[#3]

thank you for the reply Heike, it turns out someone in my org did enable Defender for Cloud Apps then quickly disabled, we went ahead and enabled the service completely.

[#4]

Perfect! Glad you found the issue and it's now working!! Whoo-whoo! 🙂