15.4 Cloud App Discovery

What Cloud Discovery Finds

Cloud Discovery is the Defender for Cloud Apps capability that maps the cloud apps your users access from your network, including apps you have not sanctioned (shadow IT). Unlike app connectors, which require admin rights inside a sanctioned app, Cloud Discovery works from network traffic logs — it does not authenticate to the apps users visit.

Cloud Discovery ingests logs from:

• Firewalls and proxies — uploaded manually as a snapshot, or sent automatically via a log collector
• Defender for Endpoint — device-level cloud app usage telemetry from managed endpoints, no log upload required
• Microsoft Entra ID Proxy / Microsoft Entra Private Access — traffic logs from the Entra proxy

Each discovered app is enriched with:

• A Microsoft risk score (0–100) computed from factors across security, legal, and general categories
• A category (cloud storage, CRM, marketing, code hosting, social, etc.)
• Compliance certifications, hosting country, and data handling attributes

---

Configuring Cloud Discovery

Option 1: Snapshot Log Upload

For a one-time assessment, upload a log snapshot:

1. In the Defender portal, go to Cloud Discovery > Snapshot reports > Create snapshot report.
2. Select the data source (e.g., Palo Alto, Cisco ASA, Squid, Check Point — Defender for Cloud Apps supports over 70 log formats).
3. Upload the exported log file.
4. Defender for Cloud Apps parses the log, extracts destination domains/IPs, and maps them to the discovered app catalog.

Snapshot reports are useful for a quick baseline but do not update automatically.

Option 2: Automatic Log Upload via Log Collector

For continuous Cloud Discovery, deploy a log collector:

1. In the Defender portal, go to Cloud Discovery > Automatic log upload > Add log collector.
2. Provide a name and select the data source(s).
3. The portal generates a Docker run command. Deploy the Docker container on a Linux server (typically in your DMZ) that can receive syslog from your firewalls and proxies.
4. Configure your firewalls and proxies to send syslog to the log collector on the configured port.
5. The log collector parses and uploads logs to Defender for Cloud Apps on the configured schedule (default every 10 minutes), producing continuous Cloud Discovery reports.

The log collector is a Docker image maintained by Microsoft; it does not require a Windows Server.

Option 3: Defender for Endpoint Integration

If you have Defender for Endpoint licensed and onboarded, you can enable Microsoft Defender for Endpoint integration in Cloud Discovery settings. This surfaces cloud app usage from managed Windows and macOS endpoints without any log upload, because Defender for Endpoint already sees the network connections each device makes. This is especially useful for discovering cloud app usage from remote users who never traverse the corporate firewall.

---

Reviewing the Cloud Discovery Dashboard

The Cloud Discovery dashboard surfaces:

• Discovered apps — ranked by risk score and traffic, with category and sanction status
• Top users — users generating the most traffic to discovered apps
• Top IP addresses — source IPs generating the most cloud app traffic
• Apps by category — where usage concentrates (cloud storage, marketing, social)
• New apps — apps seen for the first time in the reporting period

From any discovered app you can:

• Sanction the app — mark it as approved; this is informational and does not block or allow anything by itself
• Unsanction the app — mark it as not approved; combined with enforcement (below) this drives blocking
• View the app's risk score breakdown — security, legal, and general factor scores
• Request an app — submit a request to add a connector or assessment

---

Responding to Issues Identified in Cloud Discovery

Cloud Discovery is only valuable if you act on what it surfaces. Common response workflows:

1. Block Unsanctioned Apps via Defender for Endpoint

When you unsanction an app in Defender for Cloud Apps, you can configure Defender for Endpoint web content filtering to block access to that app's domains on managed endpoints. This is the primary mechanism for enforcing unsanctioned app decisions across devices.

2. Create Cloud Discovery Policies

Cloud Discovery policies automate detection of risky patterns:

• New risky app — fires when a discovered app with a risk score above a threshold appears for the first time
• New unsanctioned app — fires when a user accesses an app you marked unsanctioned
• User using unsanctioned app — fires when a specific user or group accesses unsanctioned apps
• Cloud Discovery anomaly detection — fires when a discovered app shows anomalous usage (e.g., a sudden spike in traffic to a storage app)

Governance actions for Cloud Discovery policies include alert, notify user, sanction/unsanction the app, and send to Power Automate.

3. Investigate Sensitive Data Uploads

Cross-reference Cloud Discovery with file policies: if users are uploading large volumes of data to an unsanctioned cloud storage app, combine the Cloud Discovery signal (the app is unsanctioned) with a file policy on sanctioned apps (mass download from OneDrive) to detect exfiltration. The Defender for Cloud Apps Investigation experience lets you pivot between discovered apps, top users, and their activity in sanctioned apps.

4. Export the Discovered Apps List

For compliance reporting, export the discovered apps list as a CSV so security and compliance teams can review the full shadow IT inventory.

---

Continuous vs. Snapshot Reports

Continuous reports are required if you want Cloud Discovery policies to fire on near-current data; snapshot reports only reflect the moment the log was exported.

---

Sanctioned vs. Unsanctioned

Sanctioning and unsanctioning are metadata flags, not enforcement by themselves. To actually block an unsanctioned app you must combine the unsanctioned flag with an enforcement mechanism — most commonly Defender for Endpoint web content filtering for managed devices, or a network firewall rule for on-premises users. Without an enforcement layer, marking an app unsanctioned only changes its dashboard badge.