{
  "id": "CB-M365-AUDIT-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-011.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-011",
    "title": "Connect Microsoft Defender for Cloud Apps to Microsoft 365 and enable its policies",
    "finding": {
      "title": "Microsoft Defender for Cloud Apps is not monitoring Microsoft 365 activity",
      "description": "Without the Microsoft 365 app connector and active policies, anomalous activity such as mass downloads, impossible travel or suspicious OAuth apps is not detected."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "defender-for-cloud-apps",
      "casb",
      "monitoring",
      "anomaly-detection",
      "oauth"
    ],
    "applicability": {
      "requires": [
        "Microsoft Defender for Cloud Apps"
      ]
    },
    "description": "Microsoft Defender for Cloud Apps has the **Microsoft 365** app connector connected with all\ncomponents (Microsoft Entra users and groups, Microsoft Entra management events, Microsoft 365\nactivities, files). The built-in anomaly detection policies are on, and the organization adds at\nleast policies for mass download, mass deletion and external sharing of sensitive files, and app\ngovernance policies for OAuth apps with high privileges or unusual activity. Alerts flow into\nMicrosoft Defender XDR incidents handled by the security team.\n",
    "rationale": "Defender for Cloud Apps adds behavioural detection on top of the audit log: it baselines each\nuser and raises alerts for activity from unusual locations, ransomware-like file activity,\nsuspicious inbox rules and risky OAuth apps. These detections cover attacker behaviour that\nstatic configuration controls cannot prevent.\n",
    "impact": "Licence cost (included in Microsoft 365 E5 and E5 Security). Anomaly policies need a learning\nperiod of about seven days and some tuning to reduce false positives.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Settings** > **Cloud apps** > **Connected apps** > **App connectors** and check\n   that **Microsoft 365** shows **Connected** with all components selected.\n3. Browse to **Cloud apps** > **Policies** > **Policy management** and check that the threat\n   detection (anomaly) policies are on, and that file and activity policies exist for mass\n   download, mass deletion and external sharing of sensitive files.\n4. Browse to **Cloud apps** > **App governance** and check that app governance is turned on with\n   active policies.\n5. Fail if the connector is missing or partial, or if no anomaly or custom policy is active.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Defender portal as at least a Security Administrator.\n2. Browse to **Settings** > **Cloud apps** > **Connected apps** > **App connectors** > **Connect an\n   app** > **Microsoft 365**, select all components and connect.\n3. Browse to **Cloud apps** > **Policies** > **Policy management**, review the built-in anomaly\n   detection policies and turn them on, then create activity and file policies from templates\n   (for example **Mass download by a single user**, **File shared with personal email\n   address**).\n4. Turn on app governance and its predefined policies.\n5. Route alerts through Microsoft Defender XDR incidents to the SOC.\n",
      "rollback": "Disable the policies or disconnect the app connector.\n"
    },
    "references": [
      {
        "title": "Connect Microsoft 365 to Microsoft Defender for Cloud Apps",
        "url": "https://learn.microsoft.com/defender-cloud-apps/connect-office-365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Protect Microsoft 365 with Microsoft Defender for Cloud Apps",
        "url": "https://learn.microsoft.com/defender-cloud-apps/protect-office-365",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage app governance in Microsoft Defender for Cloud Apps",
        "url": "https://learn.microsoft.com/defender-cloud-apps/app-governance-manage-app-governance",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CA-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      },
      {
        "framework": "mitre-attack",
        "id": "T1528"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-APPS-011",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-013",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}