Connect enterprise SaaS apps via API connectors in Microsoft Defender for Cloud Apps, configure Conditional Access App Control for real-time session monitoring, create session policies for download and upload protection, and test enforcement end-to-end.
App connectors use the APIs of app providers to enable greater visibility and control by Microsoft Defender for Cloud Apps over the apps you connect. API connectors provide richer data about user activities, file sharing, permissions, and account status. Conditional Access App Control extends this with real-time session monitoring and enforcement. allowing you to monitor sessions, block downloads, protect uploads, and prevent data exfiltration without blocking app access entirely.
A financial services company uses Microsoft 365, Salesforce, Box, and ServiceNow. Employees frequently access these apps from personal devices and untrusted networks. The CISO requires real-time visibility into SaaS activities, the ability to block sensitive file downloads from unmanaged devices, and protection against data exfiltration through copy/paste in browser sessions. The security team must deploy API connectors for deep visibility and Conditional Access App Control for real-time enforcement. all without disrupting employee productivity.
Without app connectors, your security team is blind to SaaS data movement. you cannot see who shared what files, which accounts have excessive privileges, or which OAuth apps access corporate data. Without session controls, you face a binary choice: block the app entirely or allow unrestricted access. Conditional Access App Control provides the granular, real-time enforcement that modern zero-trust architectures require: monitor, protect, and control. without blocking productivity.
API connectors establish a secure API connection between Defender for Cloud Apps and the target SaaS application. Each connector type provides different levels of visibility depending on the app’s API capabilities.
The Microsoft 365 connector provides deep visibility into Exchange Online, SharePoint Online, OneDrive, and Teams activities without any external API configuration.
Extend visibility to third-party SaaS apps by configuring API connectors. Each app requires administrator consent and specific API configuration in the target platform.
After connecting apps, verify that data is flowing correctly and monitor connector health for ongoing reliability.
Conditional Access App Control uses a reverse-proxy architecture to intercept user sessions in real time. Before creating session policies, you must configure the Entra ID Conditional Access integration.
# ---------------------------------------------------------------
# PURPOSE: Verify Conditional Access readiness by listing all
# existing Conditional Access policies in Entra ID.
# WHY: Before creating a new policy to route sessions through MDA,
# you need to review existing policies to avoid conflicts.
# Conflicting policies (e.g. one blocking browser access while
# another routes to MDA) can cause authentication failures.
# PREREQUISITES: Install Microsoft.Graph PowerShell module:
# Install-Module Microsoft.Graph -Scope CurrentUser
# OUTPUT: Table of policy names, state (enabled/disabled/report-only),
# and creation dates. Look for existing session control
# policies that might conflict with the one you're creating.
# ---------------------------------------------------------------
Connect-MgGraph -Scopes "Policy.Read.All"
# Retrieve all Conditional Access policies and display key fields.
# State values: "enabled", "disabled", "enabledForReportingButNotEnforced"
Get-MgIdentityConditionalAccessPolicy |
Select-Object DisplayName, State, CreatedDateTime |
Format-Table -AutoSizeCreate a Conditional Access policy in Entra ID that routes user sessions through Defender for Cloud Apps for real-time monitoring and enforcement.
Route SaaS Apps Through Cloud App Security# ---------------------------------------------------------------
# PURPOSE: Create a Conditional Access policy via Microsoft Graph
# that routes browser sessions to Defender for Cloud Apps
# for real-time session monitoring and enforcement.
# WHY: This policy intercepts browser sessions to specified apps
# (SharePoint, Exchange) and proxies them through MDA's reverse-
# proxy, enabling session policies to inspect downloads, block
# uploads, and control copy/paste in real time.
# KEY PARAMETERS:
# - State = "enabledForReportingButNotEnforced" → Report-only mode
# (safe to deploy; logs what WOULD happen without blocking).
# Change to "enabled" after 48 hours of validation.
# - IncludeApplications: GUIDs identify specific Microsoft apps:
# 00000003-0000-0ff1-ce00-000000000000 = SharePoint Online
# 00000002-0000-0ff1-ce00-000000000000 = Exchange Online
# - ClientAppTypes = "browser": session controls only work in
# browser sessions, not thick clients (Outlook desktop, etc.).
# - CloudAppSecurityType = "mcasConfigured": routes sessions to
# MDA for policy evaluation (vs. "monitorOnly" for logging).
# OUTPUT: The newly created policy object. Verify in Entra ID portal
# under Protection > Conditional Access > Policies.
# ---------------------------------------------------------------
$params = @{
DisplayName = "Route SaaS Apps Through Cloud App Security"
State = "enabledForReportingButNotEnforced" # Start in report-only mode
Conditions = @{
Users = @{ IncludeUsers = @("All") } # Target all users
Applications = @{
IncludeApplications = @(
"00000003-0000-0ff1-ce00-000000000000" # SharePoint Online
"00000002-0000-0ff1-ce00-000000000000" # Exchange Online
)
}
ClientAppTypes = @("browser") # Only browser sessions (not desktop apps)
}
SessionControls = @{
CloudAppSecurity = @{
IsEnabled = $true
CloudAppSecurityType = "mcasConfigured" # Route to MDA for policy eval
}
}
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $paramsFeatured apps (Microsoft 365, Salesforce, Box, etc.) are automatically recognized by Conditional Access App Control. For custom or less common apps, you must onboard them manually.
*.mcas.ms).mcas.ms domain)Session policies provide real-time enforcement during user sessions. Create a policy that blocks download of sensitive files from unmanaged devices.
Block Sensitive File Downloads from Unmanaged DevicesProtect sensitive data at upload time by applying sensitivity labels automatically when users upload files containing sensitive content to monitored SaaS apps.
Auto-Label Sensitive Uploads to SaaS AppsAccess policies control whether a user can access an app at all, based on conditions like device compliance, location, or user risk. Create a policy to restrict access from unmanaged devices.
Restrict Sensitive Apps from Unmanaged DevicesValidate all configured policies by testing with a representative user account across multiple scenarios.
Ongoing monitoring and tuning ensures policies remain effective without causing excessive false positives or user friction.
| Resource | Description |
|---|---|
| Connect apps to get visibility and control | Overview of API connector architecture and supported apps |
| Protect apps with Conditional Access App Control | Architecture and deployment guide for session controls |
| Session policies in Defender for Cloud Apps | Create and manage session policies for real-time enforcement |
| Access policies in Defender for Cloud Apps | Control app access based on device, location, and user conditions |
| Connect Microsoft 365 to Defender for Cloud Apps | Configure the built-in Microsoft 365 API connector |
| Deploy Conditional Access App Control for Entra ID apps | Step-by-step deployment of session controls with Entra ID |
| Content inspection in Defender for Cloud Apps | Configure DLP content inspection for file policies |
| Troubleshoot Conditional Access App Control | Resolve common issues with the reverse-proxy architecture |