You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Work with discovered apps via Graph API | Microsoft Defender for Cloud Apps
3
+
description: Learn how to work with apps discovered by Microsoft Defender for Cloud Apps via Graph API.
4
+
ms.topic: how-to #Don't change
5
+
ms.date: 06/24/2024
6
+
7
+
#customer intent: As a security engineer, I want to work with discovered apps via API so that I can customize and automate the Microsoft Defender for Cloud Apps **Discovered apps** page functionality.
8
+
9
+
---
10
+
11
+
# Work with discovered apps via Graph API (Preview)
12
+
13
+
Microsoft Defender for Cloud Apps supports a Microsoft Graph API that you can use to work with discovered cloud apps, to customize and automate the **Discovered apps** page functionality in the Microsoft Defender portal.
14
+
15
+
This article provides sample procedures for using the [uploadedStreams API](/graph/api/security-datadiscoveryreport-list-uploadedstreams?view=graph-rest-beta) for common purposes.
16
+
17
+
## Prerequisites
18
+
19
+
Before you start using the Graph API, make sure to create an app and get an access token to use the application. Then, use the token to access the Defender for Cloud Apps API.
20
+
21
+
- Make sure to give the app permissions to access Defender for Cloud Apps, by granting it with `CloudApp-Discovery.Read.All` permissions and admin consent.
22
+
23
+
- Take note of your app secret and copy its value to use later on in your scripts.
24
+
25
+
You'll also need cloud app data streaming into Microsoft Defender for Cloud Apps.
26
+
27
+
For more information, see:
28
+
29
+
-[Manage admin access](manage-admins.md)
30
+
-[Graph API authentication and authorization basics](/graph/auth/auth-concepts)
31
+
-[Use the Microsoft Graph API](/graph/use-the-api)
32
+
-[Set up Cloud Discovery](set-up-cloud-discovery.md)
33
+
34
+
## Get data about discovered apps
35
+
36
+
To get a high level summary of all the data available on your **Discovered apps** page, run the following GET command:
37
+
38
+
```http
39
+
GET https://graph.microsoft.com/beta/dataDiscovery/cloudAppDiscovery/uploadedStreams
40
+
```
41
+
42
+
To drill down to data for a specific stream:
43
+
44
+
1. Copy the relevant `<streamID>` value from the previous command's output.
45
+
1. Run the following GET command using the `<streamID>` value:
46
+
47
+
```http
48
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/<streamId>/aggregatedAppsDetails(period=duration'P90D')
49
+
```
50
+
51
+
## Filter for a specific time period and risk score
52
+
53
+
Filter your API commands using `$select` and `$filter` to get data for a specific time period and risk score. For example, to view the names of all apps discovered in the last 30 days with a risk score lower or equal to 4, run:
54
+
55
+
```http
56
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/<streamId>/aggregatedAppsDetails (period=duration'P30D')?$filter=riskRating le 4 &$select=displayName
57
+
```
58
+
59
+
## Get the userIdentifier of all users, devices, or IP addresses using a specific app
60
+
61
+
Identify the users, devices, or IP addresses that are currently using a specific app, run one of the following commands:
62
+
63
+
-**To return users**:
64
+
65
+
```http
66
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/<streamId>/aggregatedAppsDetails (period=duration'P30D')/ <id>/users
67
+
```
68
+
69
+
- **To return IP addresses**:
70
+
71
+
```http
72
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/<streamId>/aggregatedAppsDetails (period=duration'P30D')/ <id>/ipAddress
73
+
```
74
+
75
+
- **To return devices**:
76
+
77
+
```http
78
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/<streamId>/aggregatedAppsDetails (period=duration'P30D')/ <id>/name
79
+
```
80
+
81
+
## Use filters to see apps by category
82
+
83
+
Use filters to see apps of a specific category, such as apps that are categorized as *Marketing*, and are also not HIPPA compliant. For example, run:
84
+
85
+
```http
86
+
GET https://graph.microsoft.com/beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreams/<MDEstreamId>/aggregatedAppsDetails (period=duration 'P30D')?$filter= (appInfo/Hippa eq 'false') and category eq 'Marketing'
87
+
```
88
+
89
+
## Related content
90
+
91
+
For more information, see [Working with discovered apps](discovered-apps.md) and the [Microsoft Graph API reference](/graph/api/resources/security-cloudappdiscovery-overview?view=graph-rest-beta).
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
+22-9Lines changed: 22 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: What's new | Microsoft Defender for Cloud Apps
3
3
description: This article is updated frequently to let you know what's new in the latest release of Microsoft Defender for Cloud Apps.
4
-
ms.date: 06/16/2024
4
+
ms.date: 11/19/2024
5
5
ms.topic: overview
6
6
---
7
7
@@ -21,11 +21,21 @@ For news about earlier releases, see [Archive of past updates for Microsoft Defe
21
21
22
22
## November 2024
23
23
24
-
### SaaS Security initative in Exposure Management
25
-
[Microsoft Security Exposure Management](https://learn.microsoft.com/security-exposure-management/) offers a focused, metric-driven way of tracking exposure in specific security areas using security [initiatives](https://learn.microsoft.com/security-exposure-management/initiatives). The "SaaS security initiative" provides a centralized location for all best practices related to SaaS security, categorized into 12 measurable metrics. These metrics are designed to assist in effectively managing and prioritizing the large number of security recommendations.
24
+
### Defender for Cloud Apps support for Graph API (preview)
25
+
26
+
Defender for Cloud Apps customers can now query data about discovered apps via the Graph API. Use the Graph API to customize views and automate flows on the **Discovered apps** page, such as applying filters to view specific data. The API supports [GET](/graph/use-the-api) capabilities only.
27
+
28
+
For more information, see:
29
+
30
+
-[Work with discovered apps via Graph API](discovered-apps-api-graph.md)
31
+
-[Microsoft Graph API reference for Microsoft Defender for Cloud Apps](/graph/api/resources/security-cloudappdiscovery-overview?view=graph-rest-beta)
32
+
33
+
### SaaS Security initiative in Exposure Management
34
+
35
+
[Microsoft Security Exposure Management](/security-exposure-management/) offers a focused, metric-driven way of tracking exposure in specific security areas using security [initiatives](/security-exposure-management/initiatives). The "SaaS security initiative" provides a centralized location for all best practices related to SaaS security, categorized into 12 measurable metrics. These metrics are designed to assist in effectively managing and prioritizing the large number of security recommendations.
26
36
This capability is General Availability (Worldwide) - Note Microsoft Security Exposure Management data and capabilities are currently unavailable in U.S Government clouds - GCC, GCC High and DoD
27
37
28
-
For more information, see [SaaS security initiative](https://learn.microsoft.com/defender-cloud-apps/saas-security-initiative)
38
+
For more information, see [SaaS security initiative](saas-security-initiative.md).
29
39
30
40
### Visibility into app origin (Preview)
31
41
@@ -52,12 +62,13 @@ Defender for Cloud Apps users who use app governance can now get granular insigh
52
62
For more information, see [OAuth app data usage insights on app governance](/defender-cloud-apps/app-governance-visibility-insights-view-apps#getting-detailed-information-on-an-app).
53
63
54
64
## October 2024
65
+
55
66
### Internal Session Controls application notice
56
67
The Enterprise application “Microsoft Defender for Cloud Apps – Session Controls” is used internally by the Conditional Access App Control service.
57
68
Please ensure there is no CA policy restricting access to this application.
58
69
For policies that restrict all or certain applications, please ensure this application is listed as an exception or confirm that the blocking policy is deliberate.
59
70
60
-
For more information, see [Sample: Create Microsoft Entra ID Conditional Access policies for use with Defender for Cloud Apps](https://learn.microsoft.com/defender-cloud-apps/session-policy-aad#sample-create-microsoft-entra-id-conditional-access-policies-for-use-with-defender-for-cloud-apps).
71
+
For more information, see [Sample: Create Microsoft Entra ID Conditional Access policies for use with Defender for Cloud Apps](session-policy-aad.md#sample-create-microsoft-entra-id-conditional-access-policies-for-use-with-defender-for-cloud-apps).
61
72
62
73
### New anomaly data in advanced hunting CloudAppEvents table
63
74
@@ -81,9 +92,8 @@ Using _OAuthAppId_ allows the queries that consider specific OAuth applications,
81
92
82
93
For more information, see [Advanced Hunting "CloudAppEvents" Data schema](/microsoft-365/security/defender/advanced-hunting-cloudappevents-table).
83
94
84
-
## September 2024
85
-
86
95
### Enforce Edge in-browser when accessing business apps
96
+
87
97
Administrators who understand the power of Edge in-browser protection, can now require their users to use Edge when accessing corporate resources.
88
98
89
99
A primary reason is security, since the barrier to circumventing session controls using Edge is much higher than with reverse proxy technology.
@@ -101,6 +111,7 @@ For more information, see:
101
111
-[Connect apps to get visibility and control with Microsoft Defender for Cloud Apps](enable-instant-visibility-protection-and-governance-actions-for-your-apps.md)
102
112
-[Mural Help Center](https://support.mural.co/s/)
103
113
114
+
104
115
### Removing the ability to email end users about blocked actions
105
116
106
117
Effective October 1st, 2024, we will discontinue the feature that notifies end users via email when their action is blocked by session policies.
@@ -113,7 +124,7 @@ Existing session policies with this setting will not trigger email notifications
113
124
114
125
End users will continue to receive the block message directly through the browser and will stop receiving block notification via email.
115
126
116
-
Screenshot of the notify end user by email option:
127
+
For example:
117
128
118
129
119
130
@@ -146,9 +157,11 @@ For more information, see [Configure custom URL for MDA block pages](mde-govern
146
157
147
158
148
159
### In-browser protection for macOS users and newly supported policies (Preview)
149
-
Edge browser users from macOS, scoped to session policies, are now protected with in-browser protection.
160
+
161
+
Edge browser users from macOS who are scoped to session policies are now protected with in-browser protection.
0 commit comments