Getting Started with Microsoft Defender for Cloud Apps

This time I take a look at getting started with Microsoft Defender for CloudApps which is a critical tool in Microsoft 365 security for not only, discovering shadow IT, but also hunting for anomalies and investigating users and apps. A must if you use tools like Intune and Endpoint Manager. As always if you enjoy the video please hit the like & subscribe buttons. Also, any questions please pop them down below. Please note I've also included Timecodes with this video, so you can jump directly to an area of interest. Enjoy :-)

Timecodes

00:00 Start
01:50 Demo Begins - Endpoint Manager / Intune
03:01 Discovering Shadow IT - CloudApp Discovery
03:33 CloudApp Catalog & Risk Scoring
07:14 Exploring the CloudApp Discovery dashboard
08:55 Sanctioning / Un-sanctioning Apps
13:23 Investigating & Analysing User & App anomalies
18:06 Controlling Apps using Policies & Templates
21:36 Managing incidents with Power Automations
23:38 Managing Alerts
26:11 Enabling Microsoft Defender for Identity
26:35 Session conclusion

[rajeevbhandari]

Clear and crisp explanation without beating around bush. You are awesome :)

[iisely]

Thank you for the CLEAR and in-depth explanation !

[RenoAgencyWayland]

Favorite comment includes any time you say “this rocks by the way!” Awesome. You Rock Andy! Happy new year!!

[kamrul]

Hi Andy, You are one of the best tutor I have ever seen. I am glad that I have found you on youtube. I am getting real benefit in my profession from your resourceful videos. Please carry on helping people

[marcoh]

Excellent video, very practical examples. Thanks a lot!

[cenilroy]

I really like to pace of the demo, anyone can easily listen and digest quickly. Very well done.

[khanmali]

Thank you so much. I am learning lot from your channel. You are definitely one of the best instructor.

[chihebchebbi]

Thank you Andy for the amazing effort!

[SangameshN]

Hey Andy, That was great content. appreciate ur work.:)

[mohammadsadaquat]

Great video, covered them features in simple and clear way. Thank you!

[laurachonorato]

This video is perfect! Thank you much and Congrats!

[mohammedkhizar]

Great insights on MS Defender for cloud apps. Thanks and cheers !!!

[danridgewall]

I attended an office365 course and cert about 8 or 9 yeas ago. It changed my life to your teachings and I am now a consultant and specialising in o365 and mdm management. Another great video and thanks for the clean tand precise teaching you deliver

[avanigaddaeverest]

Thank you so much sir...it is very clear and easy

[dheerajmishra]

Very very useful and nice explanation.

[janiffa]

Thank you for the overview of this service. I do have a question: How do I integrate the exclusion groups from 365 Defender (ie: facebook) into MSDef for CA --group that is unsanctioned. I am having a difficult time trying to figure this one out. Any help will be appreciated!

[berrychowchow]

Thank you for the awesome video1 I went through it from beginning to the end and it helped me a lot to understand it. I do have a few questions if I may? (as I don't currently have access to any demo environment to play around to understand)
- What if there are some cloud services that M defender 365 CAN'T DETECT? say, not on their 31000 list. How can Defender do to detect those?
- Is it more for real-time monitoring? But, what if I want to download the data and do some analysis, say, to find out all the (API connection excluded) web traffic and figure out what type of structured data has been transferred during a chosen period of time - is there any module of Defender can help?

Not sure if you'll see these questions, but thanks heaps in advance!

[dennymomanyi]

Good job, you need to do more indepth MCAS/MDCA. You got this art of making things so simple and comprehensible..

[markusj]

Great vid, thanks :) Have a question, I presume the Discovery funcationality only picks up apps (shadow IT) used by AAD managed accounts? Or can it discover apps used by other (e.g. private) accounts on a managed endpoint?

[Dexter_]

Thank you for the video. How would Defender for Cloud Apps block users from using certain apps (12:08), especially 3rd party? Is it connected to Endpoint Defender and stops a user from logging in somewhere or how can I imagine this?