cirsec Baselines
Esc
Microsoft 365 tenant · Logging & monitoring

Connect Microsoft Defender for Cloud Apps to Microsoft 365 and enable its policies

When it fails: Microsoft Defender for Cloud Apps is not monitoring Microsoft 365 activity. Without the Microsoft 365 app connector and active policies, anomalous activity such as mass downloads, impossible travel or suspicious OAuth apps is not detected.

CB-M365-AUDIT-011mediumactivemanualprofile hardened

Description

Microsoft Defender for Cloud Apps has the Microsoft 365 app connector connected with all components (Microsoft Entra users and groups, Microsoft Entra management events, Microsoft 365 activities, files). The built-in anomaly detection policies are on, and the organization adds at least policies for mass download, mass deletion and external sharing of sensitive files, and app governance policies for OAuth apps with high privileges or unusual activity. Alerts flow into Microsoft Defender XDR incidents handled by the security team.

Rationale

Defender for Cloud Apps adds behavioural detection on top of the audit log: it baselines each user and raises alerts for activity from unusual locations, ransomware-like file activity, suspicious inbox rules and risky OAuth apps. These detections cover attacker behaviour that static configuration controls cannot prevent.

Impact

Licence cost (included in Microsoft 365 E5 and E5 Security). Anomaly policies need a learning period of about seven days and some tuning to reduce false positives.

Applies when

Requires: Microsoft Defender for Cloud Apps

Audit

  1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
  2. Browse to Settings > Cloud apps > Connected apps > App connectors and check that Microsoft 365 shows Connected with all components selected.
  3. Browse to Cloud apps > Policies > Policy management and check that the threat detection (anomaly) policies are on, and that file and activity policies exist for mass download, mass deletion and external sharing of sensitive files.
  4. Browse to Cloud apps > App governance and check that app governance is turned on with active policies.
  5. Fail if the connector is missing or partial, or if no anomaly or custom policy is active.

Remediation

  1. Sign in to the Microsoft Defender portal as at least a Security Administrator.
  2. Browse to Settings > Cloud apps > Connected apps > App connectors > Connect an app > Microsoft 365, select all components and connect.
  3. Browse to Cloud apps > Policies > Policy management, review the built-in anomaly detection policies and turn them on, then create activity and file policies from templates (for example Mass download by a single user, File shared with personal email address).
  4. Turn on app governance and its predefined policies.
  5. Route alerts through Microsoft Defender XDR incidents to the SOC.

Rollback

Disable the policies or disconnect the app connector.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1SI-4related
NIST SP 800-53 Rev. 55.1.1CA-7related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1530
MITRE ATT&CKT1528
  • related CB-M365-APPS-011 Review high-risk API permissions granted to applications
  • related CB-M365-AUDIT-013 Review Secure Score and Entra recommendations periodically

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr