# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUDIT-011
title: Connect Microsoft Defender for Cloud Apps to Microsoft 365 and enable its policies
finding:
  title: Microsoft Defender for Cloud Apps is not monitoring Microsoft 365 activity
  description: Without the Microsoft 365 app connector and active policies, anomalous activity such as mass downloads, impossible travel or suspicious OAuth apps is not detected.
status: active
profiles: [hardened]
risk:
  severity: medium
assessment: manual
tags: [defender-for-cloud-apps, casb, monitoring, anomaly-detection, oauth]

applicability:
  requires:
    - "Microsoft Defender for Cloud Apps"

description: |
  Microsoft Defender for Cloud Apps has the **Microsoft 365** app connector connected with all
  components (Microsoft Entra users and groups, Microsoft Entra management events, Microsoft 365
  activities, files). The built-in anomaly detection policies are on, and the organization adds at
  least policies for mass download, mass deletion and external sharing of sensitive files, and app
  governance policies for OAuth apps with high privileges or unusual activity. Alerts flow into
  Microsoft Defender XDR incidents handled by the security team.
rationale: |
  Defender for Cloud Apps adds behavioural detection on top of the audit log: it baselines each
  user and raises alerts for activity from unusual locations, ransomware-like file activity,
  suspicious inbox rules and risky OAuth apps. These detections cover attacker behaviour that
  static configuration controls cannot prevent.
impact: |
  Licence cost (included in Microsoft 365 E5 and E5 Security). Anomaly policies need a learning
  period of about seven days and some tuning to reduce false positives.

audit:
  manual: |
    1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a
       Security Reader.
    2. Browse to **Settings** > **Cloud apps** > **Connected apps** > **App connectors** and check
       that **Microsoft 365** shows **Connected** with all components selected.
    3. Browse to **Cloud apps** > **Policies** > **Policy management** and check that the threat
       detection (anomaly) policies are on, and that file and activity policies exist for mass
       download, mass deletion and external sharing of sensitive files.
    4. Browse to **Cloud apps** > **App governance** and check that app governance is turned on with
       active policies.
    5. Fail if the connector is missing or partial, or if no anomaly or custom policy is active.

remediation:
  manual: |
    1. Sign in to the Microsoft Defender portal as at least a Security Administrator.
    2. Browse to **Settings** > **Cloud apps** > **Connected apps** > **App connectors** > **Connect an
       app** > **Microsoft 365**, select all components and connect.
    3. Browse to **Cloud apps** > **Policies** > **Policy management**, review the built-in anomaly
       detection policies and turn them on, then create activity and file policies from templates
       (for example **Mass download by a single user**, **File shared with personal email
       address**).
    4. Turn on app governance and its predefined policies.
    5. Route alerts through Microsoft Defender XDR incidents to the SOC.
  rollback: |
    Disable the policies or disconnect the app connector.

references:
  - title: Connect Microsoft 365 to Microsoft Defender for Cloud Apps
    url: https://learn.microsoft.com/defender-cloud-apps/connect-office-365
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Protect Microsoft 365 with Microsoft Defender for Cloud Apps
    url: https://learn.microsoft.com/defender-cloud-apps/protect-office-365
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Manage app governance in Microsoft Defender for Cloud Apps
    url: https://learn.microsoft.com/defender-cloud-apps/app-governance-manage-app-governance
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "2.4.3"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-4
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CA-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1530
  - framework: mitre-attack
    id: T1528
related_controls:
  - id: CB-M365-APPS-011
    type: related
  - id: CB-M365-AUDIT-013
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24