Tools
Defender for Cloud Apps: bought often, deployed rarely
It is in E5, most organisations have it, and a large share have never configured a policy. What it is genuinely good at, and the two things to switch on first.
Microsoft
The gap between owning it and using it
Defender for Cloud Apps arrives with E5 and with the E5 Security add-on, which means a great many organisations own a cloud access security broker they have never opened. It is one of the most consistently under-deployed products in the Microsoft stack.
That is partly because the name suggests a large project. In practice the first two useful things take an afternoon.
What to switch on first
App discovery from your firewall or Defender for Endpoint logs
Find out which cloud services people are actually using. Every organisation that runs this for the first time is surprised, and the list is the beginning of a real shadow IT conversation.
OAuth app governance
Which third-party applications hold consent to your tenant data, granted by whom, with what permissions. This is where a quiet, long-lived compromise usually lives, and almost nobody has looked.
Anomaly detection policies, left at defaults
Impossible travel, unusual file downloads, activity from a risky IP. The defaults are reasonable and generate few enough alerts to be readable.
Session control only when you have a specific reason
Conditional Access App Control is powerful and operationally heavy. It is the right answer for unmanaged device access to a specific app, and the wrong answer as a default posture.
The verdict
Turn on discovery and OAuth app governance this week
You already own it, both are read-only, and OAuth app governance routinely surfaces something nobody knew was connected.
Skip session proxying unless you have a named use case. It changes how applications behave and the support cost is real.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.