15.1 Configuring the App Connector for Microsoft 365

What Is Microsoft Defender for Cloud Apps?

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that sits between your users and the cloud apps they use, providing visibility, compliance, threat protection, and governance across sanctioned and unsanctioned cloud services. The service was formerly named Microsoft Cloud App Security (MCAS); Microsoft renamed it as part of the Microsoft Defender family, and you will still see the legacy acronym in older documentation, PowerShell cmdlets, and license entitlements.

A CASB addresses four core pillars:

• Visibility — discover which cloud apps users access and what they do inside them
• Compliance — assess app risk, classify data, and enforce DLP-style controls
• Threat protection — detect anomalous behavior, compromised accounts, and risky OAuth apps
• Governance — sanction/unsanction apps, quarantine files, revoke sessions

Defender for Cloud Apps delivers these capabilities through three complementary mechanisms, and understanding which one applies to a given scenario is critical for MS-102:

---

App Connectors Explained

An app connector is an API-based integration between Defender for Cloud Apps and a cloud provider. When you connect an app, Defender for Cloud Apps authenticates to that provider's management and audit APIs (for Microsoft 365 this is Microsoft Graph), then periodically pulls:

• Activities — sign-ins, file operations, admin actions, OAuth grants
• Audit logs — Exchange, SharePoint, Teams, and Entra ID audit events
• Files — metadata and, where licensed, content inspection for sensitive data
• Governance actions — actions Defender for Cloud Apps can take back through the API, such as deleting a file, revoking an OAuth app grant, or suspending a user

Because app connectors use each provider's APIs, the granularity of data depends on what the provider exposes. Microsoft 365 exposes the richest telemetry because Defender for Cloud Apps is a first-party Microsoft service. Third-party connectors (Salesforce, Google Workspace, AWS, ServiceNow, Box, Dropbox, Slack, GitHub, Office 365, Okta, and many more) are supported through the same connector framework.

---

Configuring the Microsoft 365 App Connector

To configure the Microsoft 365 app connector in the Defender for Cloud Apps portal:

1. Sign in to the Microsoft Defender XDR portal ( Defender for Cloud Apps is now surfaced inside the unified Microsoft Defender portal) and navigate to Settings > Cloud Apps > App Connectors.
2. Click + Connect an app and select Microsoft 365. (Microsoft Entra ID is connected as part of the same Microsoft 365 connector family — when you connect Microsoft 365, Defender for Cloud Apps also pulls Entra ID sign-in and audit logs.)
3. In the connector pane, provide a descriptive name and review the API permissions the connector requires. These permissions include reading audit logs, reading user profiles, reading files, and reading organization information through Microsoft Graph.
4. Click Connect Microsoft 365. A Microsoft Entra consent prompt appears. You must sign in with an account that can grant tenant-wide admin consent (Global Administrator or Privileged Role Administrator) because the connector uses app-level permissions, not delegated user permissions.
5. After consent is granted, the connector performs an initial sync. Activities and audit logs begin populating within a few minutes; the full historical backfill of audit logs can take longer depending on tenant size.

What the Connector Enables

Once Microsoft 365 is connected, Defender for Cloud Apps can:

• Surface Exchange, SharePoint, OneDrive, and Teams activities in the Activity log
• Run file policies that scan SharePoint, OneDrive, and Teams files for sensitive info types and labels
• Apply governance actions such as putting a file in quarantine, applying a Microsoft Purview sensitivity label, or revoking user sessions
• Feed Microsoft Entra sign-in risk and audit events into anomaly detection and activity policies

---

Connecting Other Apps

The same Settings > Cloud Apps > App Connectors page lists every supported connector. For each third-party app you connect, you must:

• Authenticate to the provider's admin console (for example, log in to Salesforce as a System Administrator, or to Google Workspace as a Super Admin)
• Grant the API scopes Defender for Cloud Apps requests
• Confirm the connector status shows Connected with a recent successful pull

For example, the Salesforce connector pulls Salesforce audit logs and file metadata; the Google Workspace connector pulls admin activity and Drive file events; the AWS connector pulls CloudTrail and S3 metadata. Each connector's documentation specifies the exact permissions required.

---

Distinguishing the Three Mechanisms

A common MS-102 question contrasts the three ways Defender for Cloud Apps gathers data and enforces control:

• App connector (API) — you connect a sanctioned app (Microsoft 365, Salesforce) and Defender for Cloud Apps reads its APIs. Use it when you want deep, ongoing visibility and governance inside an app you have admin rights to.
• Cloud Discovery (log) — you upload firewall/proxy logs or use Defender for Endpoint to see which apps users access from your network, including shadow IT. Use it when users access apps you do not administer.
• Conditional Access App Control (reverse proxy) — Microsoft Entra Conditional Access routes the user's browser session through Defender for Cloud Apps, which then enforces session policies such as block download, require MFA, or block file upload in real time. Use it for in-session enforcement on Entra-integrated apps.

You do not need an app connector to use Cloud Discovery, and you do not need Cloud Discovery to use Conditional Access App Control. The three mechanisms are independent and additive.