Microsoft Cloud App Security

Cloud adoption—accelerated by the coronavirus pandemic—has made most organizations dependent on cloud services for business-critical applications, creating a hybrid IT delivery environment with significant management, security, and compliance challenges. These problems persist because cloud services are often poorly integrated into established IT security processes, while employees and business units frequently procure or use personal and unsanctioned cloud services without risk assessments. Expanding privacy and data regulations such as GDPR and CCPA intensify pressure, and the accessibility of cloud platforms increases exposure to data theft, corruption, and malware placement.

Cloud Access Security Brokers (CASBs) help by improving visibility and controlling user access to cloud services, but the text argues modern cloud risk requires more than a standalone CASB. Current expectations include deep integration with endpoint and network controls (anti-malware, DLP, secure web gateways) and capabilities for Cloud Security Posture Management (CSPM) to detect and remediate misconfigurations—especially as IaaS use grows for modernized applications. The market trend described is a shift from standalone CASBs toward comprehensive cloud security solutions combining CASB, CSPM, data and user protection, SWG, and zero trust network controls, with future expansion to hybrid delivery, edge computing, and 5G.

The report focuses on Microsoft Cloud App Security (MCAS), derived from Adallom (acquired in 2015) and integrated into Microsoft Enterprise Mobility + Security. MCAS provides shadow IT discovery, app risk scoring, policy-based controls, reverse-proxy conditional access, API connectors to major SaaS and cloud platforms, data classification and labeling, behavioral analytics, ransomware templates, SIEM integrations, and compliance reporting. Strengths include broad integration, threat intelligence, conditional access across apps, and simplified licensing. Challenges include limited protection for structured SaaS data (no encryption/tokenization), reliance on additional Microsoft tools for full value, weaker fit in non-Microsoft environments, and a need to broaden posture management across more IaaS resources.

• Microsoft Cloud App Security is based on the Adallom CASB acquired in 2015.
• Discovered cloud apps can be risk-classified using more than 70 factors, including regulatory and industry standards.
• The Cloud app catalogue covers over 16,000 cloud apps that are ranked and scored by Microsoft analysts.
• App scoring uses more than 80 risk factors that can be customized via scores and parameter weights.
• Conditional Access App Control uses a reverse proxy architecture for real-time visibility and control.
• Real-time controls can block downloads, detect unmanaged device activity, and restrict access from non-corporate networks.
• Microsoft Cloud App Security integrates with SIEM tools including Splunk and Azure Sentinel.
• Compliance certifications and attestations listed include ISO/IEC 27001, ISO/IEC 27018, PCI DSS, and SOC 2.
• Connected apps listed include AWS, Azure, Box, Dropbox, GitHub Enterprise Cloud, GCP, Google Workspace, Office 365, Okta, Salesforce, ServiceNow, Webex, and Workday.
• The product does not provide encryption or tokenization of structured data stored in SaaS applications such as CRM systems.

• “Most organizations now depend upon cloud services to deliver business-critical applications”
• “This hybrid IT delivery environment gives rise to many challenges in the areas of management, security, and compliance.”
• “Employees and associates use personal cloud services to perform their jobs without reference to their employer.”
• “The uncontrolled use of cloud services also increases cyber-risks”
• “Today’s CASB needs to be deeply integrated with other end user security controls”
• “The risks associated with organizational use of cloud services often stem from misconfigurations”
• “In our opinion, the market for a standalone CASB is shrinking”
• “Conditional Access App Control uses reverse proxy architecture to provide the tools needed for real-time visibility and control”
• “A policy-based approach is essential to ensure consistency and to minimize the management burden.”
• “When deployed as part of Microsoft Enterprise Mobility + Security suite this provides an excellent all round cloud security solution for Microsoft centric IT deployments.”