Cloud Discovery

Cloud Discovery is made up of four different discovery methods, in which traffic logs are digested and analyzed so that the apps that are being accessed can be scored. Let's cover these four methods and dive into each one.

Microsoft Defender for Endpoint (MDE) integration

If your devices are enrolled into Microsoft Defender for Endpoint (MDE), MDCA will use the traffic information about the apps and services that are being accessed. This is an integration that is native to the MDCA platform and requires toggling it on from the security portal, as shown in the following screenshot:

Figure 9.8 – MDCA integration within Security.Microsoft.com

Then, to enforce app access, which allows access to sanctioned apps or blocks access to unsanctioned apps, there is another checkbox in the settings within MDCA, as shown in the following screenshot:

Figure 9.9 – MDCA integration for MDE app enforcement

Again...