Rate this post

Introduction

Is there a way to block certain applications in your business environment? Absolutely. If you’re using Microsoft 365, there’s a powerful tool called Microsoft Defender for Cloud Apps that enables you to monitor and control cloud applications — and much more.

In this article, we’ll explore how this tool works, its licensing requirements, and the practical features that help businesses manage application use securely.

Why Application Control Matters

Many business owners ask whether they can monitor what cloud apps their employees use — and whether they can block specific apps altogether. The answer is yes. Microsoft Defender for Cloud Apps provides insights and control, allowing organizations to:

  • Discover unauthorized cloud apps

  • Monitor app usage

  • Block or allow apps based on risk

  • Automate responses to suspicious behavior

Licensing Considerations

Unfortunately, Microsoft Defender for Cloud Apps is not fully available with Microsoft 365 Business Premium. Here’s how the licensing breaks down:

  • Business Premium: Includes a limited version of Defender for Cloud Apps with manual log upload only.

  • Microsoft 365 E5: Includes the full version, with advanced features.

  • Alternative Option: You can also purchase Enterprise Mobility + Security (EMS) E5, which costs less than M365 E5 and can be added on top of Business Premium.

Note: EMS E5 pricing is around £13.90 per user/month, while M365 E5 is approximately £50.30 per user/month.

Key Features of Microsoft Defender for Cloud Apps

1. Cloud App Discovery

This feature reveals the actual cloud applications used across your business. Most companies are surprised by what they find — for example, unexpected use of Dropbox or other third-party tools.

Two Methods for App Discovery:

  • Firewall Log Uploads (Business Premium only): Requires manual upload of logs from appliances like Barracuda, Cisco, or WatchGuard.

  • Microsoft Defender for Endpoint Integration (Full Version): Allows automated, continuous discovery via device integration and Microsoft Intune.

2. Cloud App Catalog

Microsoft has evaluated over 33,000 cloud apps, scoring them on 90 risk factors such as:

  • Security settings (e.g., MFA support, audit logs)

  • Compliance certifications (e.g., GDPR, ISO)

  • Data handling and ownership policies

You can then:

  • Sanction apps you trust

  • Unsanction apps to block them

  • Monitor apps to warn users before access

3. Blocking or Monitoring Applications

Once apps are discovered, you can decide how they should be treated:

  • Monitor Apps: Users get a warning and an option to bypass temporarily.

  • Unsanctioned Apps: Fully blocked — no bypass allowed.

You can customize messages and redirect users to a URL with more information (e.g., a policy page).

4. Real-Time Blocking in Action

Let’s consider two real-world examples using Microsoft Defender for Endpoint:

  • Dropbox (Monitored App): User receives a warning but can bypass temporarily (e.g., for 1 hour).

  • Box.com (Unsanctioned App): Access is completely blocked with no bypass option.

Security Monitoring and Automation

Defender for Cloud Apps isn’t just about app control — it’s also a powerful security monitoring platform. It can detect and automatically respond to suspicious activities.

Example Scenarios:

  • Impossible Travel: If a user logs in from London, then 10 minutes later from New York, that’s flagged as suspicious.

  • Compromised Accounts: Automatically suspend accounts, confirm compromise, and notify IT.

  • Suspicious Email Forwarding: Detects when hackers set forwarding rules in a compromised inbox.

Policy Management and Templates

The platform includes over 28 built-in policies, covering scenarios like:

  • Suspicious inbox rules

  • Mass download detection

  • Sharing with personal email addresses

  • Unusual admin activity

Each policy can be customized to:

  • Apply to specific users or groups

  • Send real-time alerts to IT or managers

  • Automatically suspend accounts or change risk levels

You can also create custom policies based on your organization’s needs.

Conclusion

Microsoft Defender for Cloud Apps is a comprehensive, enterprise-grade tool that helps you:

  • Discover hidden app usage

  • Control or block risky applications

  • Automate responses to threats

  • Maintain compliance and data security

Related posts:

  1. Block telegram with azure defender
  2. Microsoft introduced Azure Defender – a network security solution for IoT-devices
  3. Understanding Microsoft Azure Cloud Management
  4. How to understand Microsoft 365?