You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-xdr/pilot-deploy-defender-cloud-apps.md
+32-29Lines changed: 32 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,9 +5,9 @@ search.appverid: met150
5
5
ms.service: defender-xdr
6
6
f1.keywords:
7
7
- NOCSH
8
-
ms.author: bcarter
9
-
author: brendacarter
10
-
ms.date: 05/31/2024
8
+
ms.author: bagol
9
+
author: batamig
10
+
ms.date: 01/12/2025
11
11
ms.localizationpriority: medium
12
12
manager: dansimp
13
13
audience: ITPro
@@ -112,13 +112,13 @@ This article includes guidance for both methods.
112
112
113
113
<aname="step-1"></a>
114
114
115
-
## Step 1. Connect to the Defender for Cloud Apps portal
115
+
## Step 1. Access Microsoft Defender for Cloud Apps
116
116
117
-
To verify licensing and to connect to the Defender for Cloud Apps portal, see [Quickstart: Get started with Microsoft Defender for Cloud Apps](/cloud-app-security/getting-started-with-cloud-app-security).
117
+
To verify licensing and to connect to the Defender for Cloud Apps portal, see [Get started with Microsoft Defender for Cloud Apps](/defender-cloud-apps/getting-started-with-defender-cloud-apps).
118
118
119
-
If you're not immediately able to connect to the portal, you might need to add the IP address to the allow list of your firewall. See [Basic setup for Defender for Cloud Apps](/cloud-app-security/general-setup).
119
+
If you're not immediately able to connect to the portal, you might need to add the IP address to the allow list of your firewall. For more information, see [Basic setup for Defender for Cloud Apps](/defender-cloud-apps/general-setup).
120
120
121
-
If you're still having trouble, review [Network requirements](/cloud-app-security/network-requirements).
121
+
If you're still having trouble, review [Network requirements](/defender-cloud-apps/network-requirements).
122
122
123
123
<aname="step-2"></a>
124
124
@@ -128,28 +128,31 @@ Microsoft Defender for Cloud Apps integrates with Microsoft Defender for Endpoin
128
128
129
129
If you've already set up Microsoft Defender for Endpoint, configuring integration with Defender for Cloud Apps is a toggle in Microsoft Defender XDR. After integration is turned on, you can return to the Defender for Cloud Apps portal and view rich data in the Cloud Discovery Dashboard.
130
130
131
-
To accomplish these tasks, see [Microsoft Defender for Endpoint integration with Microsoft Defender for Cloud Apps](/cloud-app-security/mde-integration).
131
+
To accomplish these tasks, see [Integrate Microsoft Defender for Endpoint with Microsoft Defender for Cloud Apps](/defender-cloud-apps/mde-integration).
132
132
133
133
<aname="step-3"></a>
134
134
135
135
## Step 3: Deploy the Defender for Cloud Apps log collector on your firewalls and other proxies
136
136
137
-
For coverage on all devices connected to your network, deploy the Defender for Cloud Apps log collector on your firewalls and other proxies to collect data from your endpoints and send it to Defender for Cloud Apps for analysis.
137
+
-For coverage on all devices connected to your network, deploy the Defender for Cloud Apps log collector on your firewalls and other proxies to collect data from your endpoints and send it to Defender for Cloud Apps for analysis. For more information, see [Configure automatic log upload for continuous reports](/defender-cloud-apps/discovery-docker).
138
138
139
-
If you're using one of the following Secure Web Gateways (SWG), Defender for Cloud Apps provides seamless deployment and integration:
139
+
- Defender for Cloud Apps provides built-in app connectors for popular cloud apps. These connectors use the APIs of app providers to enable greater visibility and control over how these apps are used in your organization. For more information, see [Connect apps to get visibility and control with Microsoft Defender for Cloud Apps](/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps).
140
140
141
-
- Zscaler
142
-
- iboss
143
-
- Corrata
144
-
- Menlo Security
141
+
- If you're using one of the following Secure Web Gateways (SWG), Defender for Cloud Apps provides seamless deployment and integration:
145
142
146
-
For more information on integrating with these network devices, see [Set up Cloud Discovery](/cloud-app-security/set-up-cloud-discovery).
For more information, see [Cloud app discovery overview](/defender-cloud-apps/set-up-cloud-discovery).
147
150
148
151
<aname="step-4"></a>
149
152
150
153
## Step 4. Create a pilot group — Scope your pilot deployment to certain user groups
151
154
152
-
Microsoft Defender for Cloud Apps enables you to scope your deployment. Scoping allows you to select certain user groups to be monitored for apps or excluded from monitoring. You can include or exclude user groups. To scope your pilot deployment, see [Scoped Deployment](/cloud-app-security/scoped-deployment).
155
+
Microsoft Defender for Cloud Apps enables you to scope your deployment. Scoping allows you to select certain user groups to be monitored for apps or excluded from monitoring. You can include or exclude user groups. To scope your pilot deployment, see [Scope your deployment to specific users or user groups](/defender-cloud-apps/scoped-deployment).
153
156
154
157
<aname="step-5"></a>
155
158
@@ -173,7 +176,7 @@ View the Cloud Discovery dashboard to see what apps are being used in your organ
173
176
174
177
The Cloud Discovery dashboard is designed to give you more insight into how cloud apps are being used in your organization. It provides an at-a-glance overview of what kinds of apps are being used, your open alerts, and the risk levels of apps in your organization.
175
178
176
-
To get started using the Cloud Discovery dashboard, see [Working with discovered apps](/cloud-app-security/discovered-apps).
179
+
To get started using the Cloud Discovery dashboard, see [View discovered apps with the Cloud discovery dashboard](/defender-cloud-apps/discovered-apps).
177
180
178
181
### Manage cloud apps
179
182
@@ -206,14 +209,14 @@ In this illustration:
206
209
207
210
You might have discovered and sanctioned cloud apps using Defender for Cloud Apps that have not been added to Microsoft Entra ID. You can take advantage of Conditional Access App Control by adding these cloud apps to your Microsoft Entra tenant and the scope of your conditional access rules.
208
211
209
-
The first step in using Microsoft Defender for Cloud Apps to manage SaaS apps is to discover these apps and then add them to your Microsoft Entra tenant. If you need help with discovery, see [Discover and manage SaaS apps in your network](/cloud-app-security/tutorial-shadow-it). After you've discovered apps, [add these apps to your Microsoft Entra tenant](/azure/active-directory/manage-apps/add-application-portal).
212
+
The first step in using Microsoft Defender for Cloud Apps to manage SaaS apps is to discover these apps and then add them to your Microsoft Entra tenant. If you need help with discovery, see [Discover and manage SaaS apps in your network](/defender-cloud-apps/tutorial-shadow-it). After you've discovered apps, [add these apps to your Microsoft Entra tenant](/azure/active-directory/manage-apps/add-application-portal).
210
213
211
214
You can begin to manage these apps with the following tasks:
212
215
213
216
1. In Microsoft Entra ID, create a new conditional access policy and configure it to "Use Conditional Access App Control." This configuration helps to redirect the request to Defender for Cloud Apps. You can create one policy and add all SaaS apps to this policy.
214
217
2. Next, in Defender for Cloud Apps, create session policies. Create one policy for each control you want to apply.
215
218
216
-
For more information, including supported apps and clients, see [Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control](/cloud-app-security/proxy-intro-aad).
219
+
For more information, including supported apps and clients, see [Protect apps with Microsoft Defender for Cloud Apps Conditional Access App Control](/defender-cloud-apps/proxy-intro-aad).
217
220
218
221
For example policies, see [Recommended Microsoft Defender for Cloud Apps policies for SaaS apps](/security/zero-trust/zero-trust-identity-device-access-policies-mcas-saas). These policies build on a set of [common identity and device access policies](/security/zero-trust/zero-trust-identity-device-access-policies-overview) that are recommended as a starting point for all customers.
219
222
@@ -241,14 +244,14 @@ For more information, see [Create session policies](/defender-cloud-apps/session
241
244
242
245
Use these Defender for Cloud Apps tutorials to help you discover risk and protect your environment:
243
246
244
-
-[Detect suspicious user activity](/cloud-app-security/tutorial-suspicious-activity)
-[Discover and protect sensitive information](/defender-cloud-apps/tutorial-dlp)
251
+
-[Protect any app in your organization in real time](/defender-cloud-apps/tutorial-proxy)
252
+
-[Block downloads of sensitive information](/defender-cloud-apps/use-case-proxy-block-session-aad)
253
+
-[Protect your files with admin quarantine](/defender-cloud-apps/use-case-admin-quarantine)
254
+
-[Require step-up authentication upon risky action](/defender-cloud-apps/tutorial-step-up-authentication)
252
255
253
256
For more information on advanced hunting in Microsoft Defender for Cloud Apps data, see this [video](https://www.microsoft.com/en-us/videoplayer/embed/RWFISa).
254
257
@@ -258,9 +261,9 @@ You can integrate Defender for Cloud Apps with Microsoft Sentinel or a generic s
258
261
259
262
:::image type="content" source="./media/eval-defender-xdr/defender-cloud-apps-siem-integration.svg" alt-text="A diagram that shows the architecture for Microsoft Defender for Cloud Apps with SIEM integration." lightbox="./media/eval-defender-xdr/defender-cloud-apps-siem-integration.svg":::
260
263
261
-
Microsoft Sentinel includes a Defender for Cloud Apps connector. This allows you to not only gain visibility into your cloud apps but to also get sophisticated analytics to identify and combat cyberthreats and to control how your data travels. For more information, see [Microsoft Sentinel integration](/defender-cloud-apps/siem-sentinel) and [Stream alerts and Cloud Discovery logs from Defender for Cloud Apps into Microsoft Sentinel](/azure/sentinel/connect-cloud-app-security).
264
+
Microsoft Sentinel includes a Defender for Cloud Apps connector. This allows you to not only gain visibility into your cloud apps but to also get sophisticated analytics to identify and combat cyberthreats and to control how your data travels. For more information, see [Microsoft Sentinel integration](/defender-cloud-apps/siem-sentinel) and [Stream alerts and Cloud Discovery logs from Defender for Cloud Apps into Microsoft Sentinel](/azure/sentinel/connect-defender-cloud-apps).
262
265
263
-
For information about integration with third-party SIEM systems, see [Generic SIEM integration](/cloud-app-security/siem).
266
+
For information about integration with third-party SIEM systems, see [Generic SIEM integration](/defender-cloud-apps/siem).
Copy file name to clipboardExpand all lines: defender-xdr/pilot-deploy-defender-identity.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -57,7 +57,7 @@ You start by evaluating the product or service and how it will work within your
57
57
58
58
Here is the workflow for piloting and deploying Defender for Identity in your production environment.
59
59
60
-
:::image type="content" source="./media/eval-defender-xdr/defender-identity-pilot-deploy-steps.svg" alt-text="A diagram that shows the steps to pilot and deploy Microsoft Defender for Identity." lightbox="./media/eval-defender-xdr/defender-identity-pilot-deploy-steps.svg" border="false":::
60
+
:::image type="content" source="./media/eval-defender-xdr/defender-identity-pilot-deploy-steps.png" alt-text="A diagram that shows the steps to pilot and deploy Microsoft Defender for Identity." lightbox="./media/eval-defender-xdr/defender-identity-pilot-deploy-steps.png" border="false":::
0 commit comments