Last but not least in my blog post series “S for Security in EMS” is about Microsoft Cloud App Security!
Microsoft Cloud App Security is a CASB (Cloud access security broker) service delivered by Microsoft that will give you several features to protect your data, users and cloud services. MCAS is giving you a great insight on
- Shadow IT visibility
- Cloud applications usage
- Notifications when users take advantage of new Cloud applications
- Dive into specific applications, users or ip addresses
Microsot Cloud App Security comes in two editions – Microsoft Cloud App Security and Office 365 Cloud App Security
To see differences in features have a look at docs.microsoft.com here
With both editions you can easily upload your firewall logs to MCAS and get a analysis on what users are using of Cloud applications from your office network or you can configure reverse proxy features with Conditional Access and MCAS giving you great insight on what applications users are using with Azure AD integration and files shared across other services outside of Office 365.
When creating a new snapshot report (aka firewall log upload) the data goes through several steps like file parsing, data analysis and then the report is created.
This is a sample on how the report could look like and what can be discovered.
Note that here you see Open Alerts on Cloud applications users are using, how many GB of data is being uploaded to what applications and much more!
Next up you also get som pritty nice alerting out of the box.
There is 26 enabled policies that will govern your environment looking for leaked credentials, multiple failed logons, imposible travel and much more
Take a look here at some alerts on imposible travel
The alert gives us rich information on IP addresses, country, what service is used and witch user are affected. A great tool to investigate a account breach!
Some of the policies available
That in mind!
Microsoft Cloud App Security or Office 365 Cloud App Security is a greate tool to use within your organization!
S for Security in EMS – Overview
Part 1 – S for Security in EMS – Azure AD Premium
Part 2 – S for Security in EMS – Information Protection
Part 3 – S for Security in EMS – Microsoft Intune
Part 4 – S for Security in EMS – Advanced Threat Analytics
Part 5 – S for Security in EMS – Cloud App Security
