APIs and Best Security Practices for Microsoft Defender for Cloud Apps update: November 2021
By Omri Amdursky, Microsoft Defender for Cloud Apps
Putting APIs in the forefront of security practices
It’s important to know how to utilize APIs in order to work with a CASB like Microsoft Defender for Cloud Apps. Let’s explore authentication, authorization, and utilization of the Defender for Cloud Apps API to streamline and customize your cloud security experience.
Why APIs?
When looking at the possible ways to consume information from Microsoft Defender for Cloud Apps, three major methods arise:
Out of these methods, API-based access is the most customizable and allows aggregation and analysis of data by the customer.
Benefits of leveraging APIs
Best practices for using APIs
In order to connect to the Microsoft Defender for Cloud Apps APIs, you must first issue an API token, enabling your authentication and confirming your identity. This method enables Microsoft to release the data solely to the authenticated users from the customer tenant. Before creating an app to use with our API, please review it so you can select the correct permission scope. These endpoints allow for accessing data, configuring your tenant, and auditing your activities.
Step by step directions
Note: the flow below describes authentication in an application context, removing the dependency from a user entity.
Permission name |
Supported actions |
Investigation.read |
Activities list, fetch, feedbackAlerts list, fetch, mark as read/unreadEntities list, fetch, fetch treeSubnet list |
Investigation.manage |
Activities list, fetch, feedbackAlerts list, fetch, mark as read/unread, closeEntities list, fetch, fetch treeSubnet list,create/update/delete |
Discovery.read |
Alerts list, fetch, mark as read/unreadDiscovery list reports, list report categories |
Discovery.manage |
Alerts list, fetch, mark as read/unread, closeDiscovery list reports, list report categoriesDiscovery file upload,generate block script |
Settings.read |
Subnet list |
Settings.manage |
Subnet list, create/update/delete |
6. Select ‘Grant Admin Consent.’
7. To add a secret to the application, select ‘Certificates & Secrets,’ select ‘New Client Secret,’ add a description to the secret, and then select ‘Add.’
Note: Don’t forget to copy your secret value when it is shown, as it will not be available later.
8. Take note of your application ID and your tenant ID. On your application page, go to ‘Overview’ and copy the Application (client) ID and the Directory (tenant) ID.
Congrats! You now have a registered application. APIs are the most customizable method of consuming data from Microsoft Defender for Cloud Apps. Managing API access with Azure Active Directory allows you to do it in the most secure manner. APIs provide increased security and mitigate more risk from inappropriate use of tokens as well as authentications and authorizations within Microsoft Defender for Cloud Apps. Streamline and customize your cloud security experience today.
To learn more about APIs in Defender for Cloud Apps, see this technical documentation page.
To experience the benefits of full-featured CASB, sign up for a free trial—Microsoft Defender for Cloud Apps.
Feedback
We welcome your feedback or relevant use cases and requirements for Defender for Cloud Apps by emailing CASFeedback@microsoft.com. Please mention APIs in the subject line.
Learn more
For further information on how your organization can benefit from Microsoft Defender for Cloud Apps, connect with us at the links below:
Join the conversation on Tech Community. Stay up to date—subscribe to our blog. |
Upload a log file from your network firewall or enable logging via Microsoft Defender for Endpoint to discover Shadow IT in your network. |
Learn more—download Top 20 use cases for CASB. |
Connect your cloud apps to detect suspicious user activity and exposed sensitive data. |
Search documentation on Microsoft Defender for Cloud Apps. |
Enable out-of-the-box anomaly detection policies and start detecting cloud threats in your environment. |
Understand your licensing options. |
Continue with more advanced use cases across information protection, compliance, and more. |
Follow the Microsoft Defender for Cloud Apps Ninja blog and learn about Ninja Training. Go deeper with these interactive guides:
|
Follow us on LinkedIn as #CloudAppSecurity or our new name, #DefenderforCloudApps. To learn more about Microsoft Security solutions visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity on Twitter, and Microsoft Security on LinkedIn for the latest news and updates on cybersecurity.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.