Microsoft Defender for Cloud Apps: Why Having It Isn’t the Same as Using It

Most organisations on Microsoft 365 Business Premium or E5 already have Microsoft Defender for Cloud Apps included in their licensing. Very few are actually using it properly. It sits quietly in the background of the tenant, switched on at some point during setup, then largely forgotten as attention moves on to the next project.

The tool itself is capable of spotting shadow IT, flagging risky app behaviour, and enforcing data protection policies across the cloud services your staff use every day. But licensing something and managing it are two different things, and the gap between the two is where risk quietly builds, often without anyone noticing until it causes a problem. A tool that’s technically present but practically unmanaged offers very little real protection, whatever the licensing page might suggest.

That gap shows up even in well-run organisations, usually for the same handful of reasons. Staff sign up to convenient new tools without IT ever knowing. Policies set up months or years ago no longer reflect how the business actually works today. Alerts arrive and sit unread because nobody has been given clear ownership of them. None of this happens through carelessness; it happens because security tools get treated as a one-off setup task rather than something that needs ongoing attention.

Research from Capterra found that SaaS and other cloud services account for 69% of shadow IT instances in small and medium-sized businesses, which is exactly the kind of activity Defender for Cloud Apps is designed to surface. The tool doing that job well depends entirely on someone being on the other end of it.

Closing that gap comes down to a small set of consistent habits rather than anything complicated, and it starts with understanding what the tool is actually meant to do.

Microsoft Defender for Cloud Apps

Quick summary

A licence for Microsoft Defender for Cloud Apps does nothing on its own. It needs setting up, tuning, and reviewing on an ongoing basis, or it becomes another dashboard nobody looks at.

  • Shadow IT creeps back in as staff sign up to new cloud tools using work email addresses
  • Policies that were sensible on day one become outdated as the business changes
  • Alerts get generated but never actioned because nobody owns that responsibility
  • Personal cloud storage and unsanctioned AI tools often go undetected without active monitoring

The tool was never the problem. The absence of anyone consistently watching it is.

What Microsoft Defender for Cloud Apps actually does

Microsoft Defender for Cloud Apps (formerly known as Microsoft Cloud App Security, or MCAS) is Microsoft’s cloud access security broker. It sits between your organisation and the cloud services your staff use, giving visibility into what’s being accessed and applying policies to keep sensitive data under control. It builds that picture by connecting directly to sanctioned services such as SharePoint and OneDrive, alongside firewall and proxy log data that reveals the cloud services staff are using outside of anything IT has approved.

In practical terms, it can:

  • Discover cloud apps in use across your organisation, including ones IT never approved
  • Apply policies that block or restrict risky behaviour, such as uploading sensitive files to personal storage
  • Flag unusual account activity that might indicate a compromised account
  • Feed into your Microsoft Secure Score, giving a rough sense of your overall security posture

On paper, that’s a strong set of capabilities. In practice, most of it depends on someone actively configuring and reviewing it.

Why “we have the licence” isn’t the same as “we’re protected”

This is the part that catches organisations out.

Microsoft Defender for Cloud Apps doesn’t do anything meaningful straight out of the box. Cloud discovery needs pointing at the right data sources. Policies need to reflect how your organisation actually works, not a generic template. Alerts need somewhere to go and someone responsible for acting on them.

Without that ongoing attention, a few things tend to happen quietly over time:

  • Shadow IT returns. Staff find new tools that make their job easier and sign up using a work email, without IT ever knowing. The discovery feature will surface this, but only if someone is checking it.
  • Policies drift out of date. A policy that made sense when it was written can become too loose, or too restrictive, as the organisation grows and working patterns change.
  • Alerts pile up unread. A tool that generates alerts nobody looks at provides the appearance of security rather than the reality of it.

None of this is a fault in the product. It’s what happens to any security tool when it’s treated as a one-off setup task rather than an ongoing responsibility.

What proper ongoing management looks like

A well-managed Defender for Cloud Apps setup usually involves a small number of consistent habits, rather than anything complicated:

  • Regular app discovery reviews. Checking what new cloud apps have appeared in the environment and deciding whether they’re sanctioned, restricted, or blocked.
  • Policy tuning as the business changes. Revisiting policies periodically rather than leaving them as they were on day one.
  • Alerts that actually get actioned. Someone needs clear ownership of responding to flagged activity, not just receiving the notification.
  • Feeding findings into the bigger security picture. Cloud app activity shouldn’t sit in isolation. It should inform your wider Microsoft 365 security posture alongside things like Secure Score and Microsoft Purview.

In practice, this looks like a new AI writing tool showing up in a discovery review because a couple of staff members started using it that month. Someone checks what data it can access, decides whether it’s safe to allow, restrict, or block, and the decision gets applied there and then rather than surfacing months later during an audit, or not at all.

Common mistakes organisations make

A few patterns come up repeatedly when we look at how organisations are using Defender for Cloud Apps:

  • Assuming the default policies are sufficient without ever reviewing them
  • Treating cloud discovery as a one-time exercise rather than an ongoing process
  • Nobody being formally responsible for reviewing alerts
  • Not connecting Defender for Cloud Apps findings to broader identity and access decisions

Avoiding these isn’t about buying more tools. It’s about making sure the ones you already have are being looked after properly.

The bottom line on Microsoft Defender for Cloud Apps

If your organisation has this licensed but nobody could tell you the last time someone reviewed the policies or acted on an alert, you don’t currently have the protection the licence implies. The capability is there. What’s usually missing is the ongoing operational discipline to use it properly.

That’s not a criticism of any one organisation. It’s simply what tends to happen when security tools are treated as a setup task rather than a managed service.

Our Microsoft 365 Support service includes ongoing management of tools like Defender for Cloud Apps as standard, so policies stay current, alerts get actioned, and shadow IT doesn’t quietly creep back in. If you’d like a clearer picture of where your organisation currently stands, our free Microsoft 365 risk and cost health check is a good place to start.

Frequently Asked Questions

Is Microsoft Cloud App Security the same as Microsoft Defender for Cloud Apps?

Yes. Microsoft renamed Microsoft Cloud App Security (MCAS) to Microsoft Defender for Cloud Apps, as confirmed in Compare Microsoft Defender for Cloud Apps and Office 365 Cloud App Security. The underlying capability is the same tool under a new name, now positioned as part of the wider Microsoft Defender suite.

Do I need to buy Defender for Cloud Apps separately?

Many organisations already have it included in their existing Microsoft 365 licensing, depending on the plan. It’s worth checking what’s already included before assuming it needs purchasing separately.

What’s the difference between Defender for Cloud Apps and Microsoft Purview?

Defender for Cloud Apps focuses on visibility and control over cloud app usage, including shadow IT discovery. Microsoft Purview focuses more broadly on data governance, compliance, and information protection. The two work well together rather than replacing one another.

How often should Defender for Cloud Apps policies be reviewed?

There’s no fixed rule, but policies should be reviewed whenever the business changes meaningfully, such as adopting new tools or changing working patterns, alongside a regular periodic review, typically quarterly, to catch anything that’s drifted.

Can Defender for Cloud Apps stop staff from using unauthorised apps?

It can flag and restrict access to unsanctioned apps depending on how policies are configured, but this depends entirely on those policies being set up and maintained correctly in the first place.