Microsoft Defender for Cloud Apps Reviews

MCAS was onboarded for the purpose of detecting shadow IT. As the organization moved towards more SaaS solutions, we wanted to make sure that there is a way to monitor and govern the IT services coming up as shadow IT. We are a very big organization where a lot of services get onboarded, and some of the things may go unnoticed. We wanted to detect the shadow IT software being installed or shadow IT happening within a department or business unit.

We also wanted to make sure that the cloud access security broker provides a DLP kind of solution for Office 365. For example, if I am uploading a document with PI data, MCAS should scan and make sure that the right classification is applied. When the right classification is applied, the document gets encrypted, and relevant information protection is applied. If the right classification is not applied, the users are alerted to make sure that they go and remediate the document, task, file, etc.

This is how we started with this solution the last year. Going forward, as a strategic solution, we are also looking at using MCAS to govern the Office environment. We have started onboarding solutions like Microsoft Teams, SharePoint Online, OneDrive, and Exchange Online. 

Our setup is a mixture of on-premises and cloud solutions. At this point in time, the major cloud providers are AWS and Azure, and we also have on-premises products such as Symantec DLP, Doc Scan, etc.

There are certain regulatory requirements in our bank for personal data and confidential information that need to be monitored from a security standpoint. It is a regulatory and standard requirement to have such a solution in place. 

MCAS is a dedicated solution for Office 365 and other productivity-related solutions, and it really helps to automate some of the processes. It would have been difficult for us to find a similar product. It gels well with some of the solutions or technologies that we have, especially with Microsoft Azure and Office 365.

From a security monitoring perspective, there is a productivity improvement and fewer human errors.

In terms of user experience, if users mistakenly put PI information or some kind of data, it can detect and alert them. From that aspect, it is doing the job, but we are using it from a security standpoint. I'm more from a regulatory environment, and there are security requirements that are enforced by regulators. So, we cannot provide some of the end-user experience features, and there should always be a balance between the end-user experience and the security standpoint. MCAS is more of a backend security posture product. I won't position it as enhancing the user experience.

The feature that helps us in detecting the sensitive information being shared has been very useful. In addition, the feature that allows MCAS to apply policies with SharePoint, Teams, and OneDrive is being used predominantly.

It is a kind of unified solution. As compared to other solutions such as Netskope, Symantec, or McAfee, it provides a more unified reporting structure.

It also integrates with other technologies. We have Azure Information Protection, and it goes well with the solutions that we are already using.

It takes some time to scan and apply the policies when there is some sensitive information. After it applies the policies, it works, but there is a delay. This is something for which we are working with Microsoft.

It cannot detect all the things that are required as per our bank's standards. We are working with Microsoft to see how they are going to help us resolve this, and based on NDA, which new features are coming in because we require a unified solution. We have other security solutions that are working on top of it, but we don't want to use multiple solutions and then end up with a human error. From a security perspective, the weakest link is human error. If certain features are monitored by MCAS, certain features are handled by Zscaler, and certain features are handled by Symantec DLP, it becomes difficult to synchronize from an operational standpoint. This is the situation we are in currently, but these issues come with new products or new cloud solutions. We have to slowly orchestrate and see how to unify the solutions. So, at present, it doesn't solve all the problems. There are many problems, but at least, we have other solutions that are currently providing some mitigation.

It doesn't provide any way to scan Microsoft Teams when an external exchange of images is happening. You can always do the filtering on the documents during the chat, but if there is an image, then some kind of OCR capability is required to detect it. At present, there is no way MCAS can go and detect those kinds of images and alert us. They can maybe integrate it with an existing OCR-capable product. This is something that we are absolutely looking into. There should also be a feature to immediately increase the time to detect some PI information being exchanged via chat.

Its reporting capabilities can be better. Currently, to generate reports, you need to have Power Automate in place. If such capabilities are built into the product, it would be easier because when we bring in Power Automate, we need to make sure that Power Automate also gets monitored from the DLP and governance standpoints. MCAS doesn't have many reporting capabilities, and it's really an operational nightmare to get all these things done at this point in time by using MCAS. These are some of the operational capabilities that our engineers require from this solution from the reporting perspective. Symantec and other solutions are more mature in this area. It could be because MCAS is still an upcoming product.

We onboarded Office 365 and cloud services less than two years ago. MCAS was one of the strategic and DLP kind of solutions for Office 365 and other productivity products. Because the onboarding of the cloud services is in phases and not everything can be onboarded at the same time and it requires the involvement of different security and project departments, MCAS was onboarded last year.

From an enterprise perspective, it meets most of the interoperability requirements. So, scalability is there. I don't see an issue from the scalability perspective. Only features are missing here and there.

Currently, it is almost serving the entire bank. In terms of the SaaS products that MCAS is monitoring and the number of users it is serving, we have onboarded around 40,000 users for Office 365 and other SaaS products. Eventually, it will be serving the entire bank, but at this point in time, it is only serving all Office 365 and SaaS product users. 

It is more of a cybersecurity solution for the bank to comply with all the security requirements and meet the security quotient. The end users don't see MCAS as a direct solution, but MCAS is providing security services for the bank behind all the services.

We have proper help desk support. For example, if someone uploads a document that has PI data and there is an issue, it is highlighted to the user asking them to remediate it. The manager is also copied. The help desk takes care of such things. 

Once the solution is implemented, it is almost auto-run. From the support perspective, it is mostly about why did I get this alert, what was wrong with this document, etc. Such things are usually taken care of by the user because users are responsible for what content they are allowed to load on a particular website, SharePoint site, or software. A robust change management process and help desk are already in place, and I don't see a big concern on this aspect.

Previously, we didn't have any cloud product. We only had on-premise products. Our organization joined the cloud around one and a half years ago mainly because of this pandemic situation.

It depends on the requirements. Certain requirements are really complex. The deployment itself is quite fast because MCAS is on the cloud, but there are a lot of requirements from the regulations and the bank's standards perspective.

It took us one week for the architecture and to decide things like whether we need a reverse proxy. To have all the requirements and get all the things done in an enterprise environment, typically, a simple product like MCAS can take three to six months. That's because there are a lot of governance requirements, and we need to make sure there is no PI data, and the keys are encrypted somewhere in the user ID part. 

In terms of the implementation strategy, at the high level, for Office 365 and SaaS solutions, we wanted a unified product to replace our existing one. From the strategy perspective, we wanted to go to the cloud. MCAS was able to integrate with most of our Office productivity tools. We procured the licenses and then went through the strategy of the bank and how the product can meet the needs. This was at a very high level. Of course, when we go into operations, we get operational challenges. That's why we need to have a longer time period to make a product coexist with the existing products.

We have our own department, and they are trained in it. We also engage all sorts of vendors to provide us the results. At least for the interiors, we do not engage a third-party reseller or contractor.  

It was more of an in-house implementation, but Microsoft helped us in coming up with a service design for Azure-related products including Office 365. Based on our requirements and infrastructure, they provided high-level architecture and design documents and told us about the things to be included or considered. We took that service design document and built our operations based on that and got it to work. So, the service design came from Microsoft, but hands-on was by our bank.

In terms of maintenance, this is actually managed by security folks and cybersecurity services. Currently, it is being managed by three people. There are only three operators. Of course, when there are new things to be implemented and new policies to be created, it goes to engineering. For changes, we need one more person on average. So, there are a total of four people.

I can't give a specific number. One of the returns on investment is that we will soon be getting rid of our on-premise infrastructure and maintenance. The CapEx costs and repeated hardware refresh cycle are gone. From that perspective, there are savings. All we need is the skill set to maintain and manage a particular cloud access security broker. Today, we have four people, and tomorrow, it could be eight people because of the increase in the number of applications. The bottom line is that we will get rid of all operational issues in terms of patching and fixing different systems. We don't have to patch the Windows systems, Linux systems, etc. All these are taken care of and are maintained in the cloud.

I'm not totally involved in the pricing part, but I think its pricing is quite aggressive, and its price is quite similar to Netskope. 

Netskope has separate licensing fees or additional charges if you want to monitor certain SaaS services, whereas, with MCAS, you get 5,000 applications with their Office 365. It is all bundled, and there's no cost for using that. You only have the operational costs. In the country I am in, it is a bit difficult to get people with the required skill sets.

I have been here for just around one year.  When I came, they were already using MCAS. In my previous organization, I made the decision to use MCAS for Office 365. For the entire cloud, I decided to use a dedicated cloud access broker like Cisco. It really depends on the organizational requirement and how they want to size their IT department. 

There are pros and cons. If you are totally on Microsoft products, MCAS has an integration. Otherwise, there are other products that may work better. Of course, you may still be dependent on some APIs from the cloud providers. It really depends on the organization's strategy.

My advice would be that an organization should assess where they are today and then map out what do they want from a cloud access security broker product. After that, they should decide whether MCAS or another product meets their requirements. This is important because you may have all the things in terms of interoperability and a solution may be the best fit from an operational perspective, but if all of the requirements are not met, you may end up using multiple products. Therefore, an organization must assess its current IT infrastructure, where do they want to go, and what are the key requirements from a regulatory and IT governance standpoint. They also have to make sure they have the right skillset in the market. For example, in Singapore, if I want to implement Google Cloud, the skillset is very less as compared to the skillset for AWS.

From a vendor perspective, you should assess the reputability of the vendor and what kind of capability the vendor provides. For example, it's very obvious that Microsoft is very good at integrating its own products. They have now also started to integrate with others. These are some of the aspects you should consider before making a decision between product A or B. There is no magic silver bullet.

From a security standpoint, overall, it has satisfied 80% of our requirements in terms of regulatory and bank standards. For 20% of our requirements, we still need additional products or features. They are currently not really there, and we are trying to find the solution for those gaps. In general, MCAS has a long way to go. It is definitely a good product that integrates with Office 365 Suite very well, but from a capability perspective, other products such as SkyHigh, McAfee, or Symantec have more features. It has the potential. A lot of features are lined up in MCAS, and eventually, they'll be there. These features are mentioned on Microsoft's website, and they are in development. I am looking forward to those.

In terms of data governance, we have a very good tool, and we just need to focus on how to govern the data, DLP policies, etc. We don't have to bother about the physical data center, physical network, or physical host. The entire layer below the server is gone, and we just have to focus on the identity and security aspects. We just need to focus on what kind of security we need to put and which policies do we need to implement. We get better visibility by focusing on the key client endpoints by using MCAS. The team is now really focused. Previously, every day, teams used to come up with issues like, "Network has this problem. Data has this problem, and Host has this problem." Now the focus is, "Hey, this MCAS DLP isn't doing the job." The focus is more on the product's capability.

I would rate Microsoft Cloud App Security a seven out of 10.

I am not sure if the product has improved our organization yet. However, it certainly gives another level of confidence that the assets are secure. We are aware of the activity in the tenant.

The product’s most valuable feature is SQL database. It notifies us even in case of false positives when people log in after a long time and when we're out of compliance with the security baseline.

Microsoft Defender for Cloud Apps’s technical support services needs improvement.

We have been using Microsoft Defender for Cloud Apps for three years.

The product has good stability.

The product has good scalability.

The technical support services need improvement. They take a while to get responses. Their first-level engineers are generally not skilled. It takes time to get an engineer who can help us. Usually, whenever we come up with a problem, it is something that we can’t figure out on our own. We have to go through the process of submitting a ticket, waiting for a callback, and then finally getting help.

Neutral

I have used other products while working at other places. They all are more expensive than Microsoft Defender for Cloud Apps.

The initial setup process was simple. We had to merge the landing zone and part of a template. Later, we started the portal and selected resources we wanted to protect along with the level of protection. The implementation strategy is to just start using it.

We did the product implementation ourselves.

I haven't tracked an ROI for the product. It was set by default while setting up Azure Tenant. It has been successful in monitoring activities and keeping the network safe. It is less expensive than buying a separate license. It provides ease and convenience of use. We just turn the product on by default.

The product has helped save a medium amount of money. It has pretty good pricing.

I don’t know if the product provides a single pane for managing immune access. We connect it with the Active Directory and other similar tools. It helps save a low amount of time.

I advise others to try using Microsoft Defender for Cloud Apps. I rate it an eight out of ten.

We use it to protect our users' devices against attacks. 

We see stories about attacks in the news, including phishing and spam, Defender helps protect us.

It also gives us an ecosystem. We have one portal where we can manage everything. We don't need to log in to another portal to manage the devices, the antivirus, Defender, or Office. It's a single place to manage everything and that's very good.

It's very easy to install and it includes the Intune portal from Microsoft where I can control all the devices from one place. And because it's a Microsoft product, it integrates with Windows 10 and Windows 11. We don't need to buy anything else.

We have an M365 license and we have an Office admin portal. I manage all the users and licenses through the portal, making it very easy to manage. We have a lot of users coming in and going out of the company, and this makes it simple to provide licenses to people.

I would like to see them include more features in the older licenses. There are some features that are not available, such as preventing or analyzing cloud attacks. We have Defender P2 licenses and Microsoft proposed P3. If it included what was in the old package, such as the M365 license and Office, that would be very good.

I have been using Microsoft Defender for Cloud Apps (MDA) for two years.

The stability is very good. We haven't had downtime. When we receive a message that the service is down, it's only for a few minutes and then all is good. That's true for the whole Microsoft universe, since we use Outlook and Teams.

We haven't had any problems with scalability. We moved all devices from Windows 10 to 11 and it was very easy. We didn't need to test the machines. It worked very well.

We have 50 users of the solution.

The support from Microsoft is very good. Their chat system is very good because it's an alternative to phoning and it's very quick. Through the chat we quickly have someone to respond to our questions.

Positive

At first we used Panda, and after that we had McAfee. We replaced McAfee with Defender. Panda's client was very heavy on the device and, with McAfee, the benefit versus the cost was not so good.

Also, I spoke to colleagues at other companies that have implemented the solution and they said it's very simple to install.

We have seen ROI because there have been some attacks, but they have always been contained.

It's expensive because we have to pay for an M365 license and it is included in the package.

We tested Cisco Umbrella but the price was a little higher than Defender's price, and it would have been another product to install. Defender was almost "included," meaning it was easy to install.

The solution is primarily used for cloud visibility and getting a better understanding of what the data footprint is, including what kinds of files are exposed, and getting our heads around compliance. It's a component that adds DLP. Presently, there are two separate DLP policies between Microsoft's traditional DLP and the MCA DLP. 

The solution is bundled with E3 and E5 licenses. That's the reason it's most commonly deployed. It's part of the bundle. It's not a separate cost.

If your business requirements are relatively simple, it can get the job done. 

If you have more elaborate needs or if you have some more sophisticated use cases, for example, if you need an in-line component, or if you need to distinguish between sanctioned and unsanctioned applications, this solution doesn't cut it. You need to have some other solution.

Microsoft seems to want to mitigate that visible gap by deploying Microsoft DTP Defender for the in-line component. If you consume Microsoft, the more pieces you have, the better it is, although that's not necessarily true, technically speaking. They have limited deployment options. You have limited use cases for an endpoint with the firewalls port for IP tunnels for real-time traffic interception. You have to rule the endpoint. It's a less flexible deployment than the more mature players.

There are challenges with detection and there are challenges with false-positive rates.

They're improving it all the time. I haven't looked at it for six months or so, however, the last time I looked at it, they had to be configured in two different spots.

I've been dealing with the solution for a while, on and off. 

A lot of customers that we work with have the solution installed today and we see them running it by themselves as well.

The solution is stable. I haven't bumped any stability issues.

I haven't tested the scalability. I don't have any opinion on the scalability. It seems to me that it fits the customer's needs from a scalability perspective.

I don't work with technical support directly.

The solution is super easy to configure. All it requires is an admin for the various apps. Once it's authorized it can start the scans. Mainly, you need to be mindful of policies and what you're looking for. Tuning policies and making sure that your policies are set properly is important. It's very easy to do, especially the out-of-box stuff. 

You can buy it alone, however, it's not worth it. Nobody buys it alone as it's not that good as a standalone product. It's better as a part of the E3 and E5 suites. We don't sell it.

We're a Microsoft partner.

I'd rate the solution at a seven out of ten.

Mainly you want to just be clear on what your use cases are, and what you're trying to accomplish, as everything's use case driven. If you know what you need to accomplish from a security strategy standpoint, it's better. For example, it might be helpful for compliance or having an understanding of where sensitive data is. It might be part of a broader initiative around classification and data protection. Having those use cases written out first and going from there is better. Then, I suggest taking a measured approach as you go in. Implement it right. Test for or validate that the policies that you have in place are working as expected. However, you have to build out requirements for the policies. 

If there's any data that is taken out from their corporate applications, on their managed devices, and being taken out and stored somewhere else, on an application that is not managed, they don't have visibility on that.

Therefore, with Cloud App Security, the main use case is to identify information about applications that are way beyond their boundaries and to understand what people are accessing them as well as if those applications are safe or not. It's a Shadow IT discovery solution.

Apart from that, it's a solution used to protect corporate data from being taken out of those applications and being shared externally with people who are not meant to have those documents or data. It's a solution designed to prevent exfiltration and data filtration of corporate data from those applications to unknown people that may happen without proper visibility.

Basically, it's used for two purposes: providing control of the data that is in cloud applications, and shadow IT discovery. That's the major purpose of Cloud App Security.

This solution acts as an identity and posture management assessment solution also. When you have your on-prem AD integrated with Defender for Identity, it can understand your identity posture.

It can understand things like your Active Directory spread or the current state of your Active Directory on certain recommended practices. For example, if users in your organization are not using secure log-in methods. If their LDAP authentication is not secure, you'll get that information. That's identity and posture management. For your on-prem AD, if you have the solution deployed, which is Defender for Identity, it'll give you an understanding of your identity state, of your on-prem AD state, and give you recommendations accordingly, on what needs to be changed and managed, to make sure that you're secure.

Apart from that, it also integrates with third-party solutions and services. For example, in an organization with multiple cloud applications. Typically, you don't have visibility over user activities or logs. You don't have control over the data. If a user logs in from one location and then the user logs into that application from another location, you don't have the visibility as you don't have ML and AI capabilities inbuilt. With this solution, once it integrates with those applications, it has inbuilt default functionality of ML and automation. It is able to understand the user's behavior and identify inconsistencies in user accounts, for those applications, and can give you suggestions or raise alerts. 

The solution does not affect a user's workflow. It is not a user-specific solution. Users would not see the change in their usual behavior and their usual activities as such. The user does not really know what's happening in the background. The Cloud App Security is a solution for your whole organization, to make sure that you're monitoring the right activities - for example, those activities that are really uncommon - or specific activities that you want to monitor. The company has the ability to create Cloud App Security policies for sets of users, however, the users themselves do not see or feel the impact. 

An IT administrator manages the solution and it gives them a lot of information. They can see a lot of detail around how other users interact with data and applications across the company, and if anything unusual happens. 

The integration with macOS operating systems needs to be better. The Cloud App Security integrates with Windows Defender for Endpoint, which is able to monitor the traffic from Windows 10 operating systems. When it integrates with Defender for Endpoints, the macOS capability does not let you directly see the shadow IT discovery. You have to be in your network, to be able to see if any activity from a macOS operating system is happening. If you're working from home without a VPN connection nowadays, which is the usual case for a remote workplace, you can't really monitor or track the activities in the shadow IT that users are using offsite on macOS operating systems.

The Cloud App Security integration with external DLP solutions is not so seamless. There are solutions that you can integrate with Cloud App Security as an external DLP solution, however, it's not so seamless that you can have the integration with the endpoint. It's there, yet, it's not so seamless and integrable.

I've been using the solution for the past five years.

It's been stable for the past little while. The improvement has been immense, however, overall, it's a stable solution. It has not changed so much. Of course, the implementation of feature sets and improvements have happened, although they're almost similar. I would say it's a stable solution in general.

An average organization would almost utilize 100 to over 150 applications. They wouldn't really have an understanding of what activities are happening across those corporate applications. You can integrate N number of applications. There are approximately 16,000 plus applications that you can monitor and integrate with Cloud App Security. Then, based on those applications, you can understand the users' behavior.

The benefit you get is that you are able to monitor all your applications and control the data that goes out of those applications. You can also control any sort of activity, which you feel should not be happening on that application. The user can be prevented from doing certain activities. Cloud App Security helps you do that across as many apps as you want.

In terms of users. the default Cloud App Security is just a license-based solution. As long as you have users in your organization, you just buy licenses from Microsoft and assign those licenses to your user accounts. It's very scalable. 

There are a few parts to it. For example, shadow IT discovery, which is an added feature that allows you to be able to implement additional users in your organization. The Cloud App Security will also require additional infrastructure. Let's say if the data set that Cloud App Security is absorbing at a particular time span, if it increases, then you probably have to implement additional on-prem resources or cloud resources for it to be able to track all of the network data.

Depending on the data set that you're ingesting in Cloud App Security, you might have to increase your workload on-prem. Other than that, Cloud App Security itself is a very scalable solution.

When it comes to the size of organizations I've worked with, I should note I am personally a Microsoft consultant only. I work on Microsoft projects and with Microsoft's clients only. I've worked with organizations with 15,000 users and an organization that has approximately 6,000 users. I've worked with organizations that have 500 users. The size of the company varies.

Microsoft has different support tiers. If it's Pro support I would rate it at a seven or seven-and-a-half at a maximum. There are Premier support services and there are Professional supports, another type of support service. Premier support service is very good. I would rate that at an eight-and-a-half or nine. 

Pro support is if you buy a basic license for an organization. It's not so great and yet still good. For Pro support, you usually do not get routed to Microsoft people. Those are generally people who are third-party support service providers.

The problem is, specifically in India, it's also specific to locations, as sometimes if you're working in a different location, you get different support. As I mentioned, it's third-party support usually that you get with Cloud App Security or any Microsoft solution Pro support.

The level of knowledge you get is totally dependent on how the organization and how the third-party service provider is. Usually, there are time delays. Sometimes their initial response will happen, and then they will take time in responding back and/or aligning a resource. Sometimes that resource is not technically advanced or technically skilled and can't fully understand the problems at hand. In that case, they require escalating most of those cases to the technical consultants. If it's a typical question, a typical scenario, I would say it's good. Cloud App Security is a beast of a product, so the major issue is with the Pro support.

If it would have been directly with Microsoft, this help has been really good, however, it's a third-party service provider who's helping you out, and they just don't have the insights an actual Microsoft user has. 

I don't have any experience working with a third party or a competitor of Cloud App Security, however, I know there is one called McAfee, which is supposed to be equally good.

McAfee offers a cloud app security service that is very, very good and close to what Microsoft offers. That is what I understand from customers and the discussions I've had surrounding it, though I have not really worked on McAfee. What I understand from customers is, Cloud App Security, the integration, the capabilities that it has to offer, are much more advanced. For example, Microsoft's identity posture assessment. There is no solution in Europe, anywhere, which offers such a capability. It's an integrated solution with Defender for Identity, however, it's a service that Cloud App Security at least offers, which otherwise would not be available.

Similarly, integration with the number of applications, as I mentioned, is great with Microsoft. The capability for you to monitor and route your traffic for all of these different applications, and to be able to analyze the traffic from those corporate applications is important.

The reverse proxy capability that Microsoft Cloud App Security offers is really good. It lets you track anything in real-time, and monitor all those things, which is not possible using other solutions.

The initial onboarding of Cloud App Security with Office 365 is pretty straightforward. For an organization that does not use Office 365 as its primary SaaS application, you will still have to follow a few steps, however, those are also straightforward steps.

In general, I would say, Cloud App Security implementation, within the initial adoption of an application, is very seamless. 

The time it takes to deploy depends on the use cases. If you're talking about a simple activation of Cloud App Security, and enabling and monitoring the activities of certain basic applications, it shouldn't take more than a few hours for integration. If there are more complex situations, more complex scenarios, depending on what the scenarios are, then there may be a little bit more effort and time required. Other than that, if the default integration with applications is already there, it should not take more than a few hours to have it up and running.

I've worked with almost eight to 10 customers using Cloud App Security. This is Microsoft Cloud App Security. Cloud App Security has two offerings. One is Office 365 Cloud App Security, which is a basic cloud app security. Then there is Advanced Cloud App Security which is called Microsoft Cloud App Security.

The Office 365 one, the one which you get with E5 licenses, it'll give you basic Office 365 monitoring and snapshot reports, but not a whole lot of capabilities.

That said, I don't have any information about the actual costs of the license themselves. 

I deploy this solution. I don't utilize this solution as a solution for my organization, and instead, deploy this solution for clients. I'm a consultant for this product. My company is a Microsoft partner. 

This is a SaaS application.

I would advise new users to first try to identify the applications which are corporate-owned applications, be it if it's an on-prem application or if it's a cloud application. Once you identify all those applications which you're using in your organizations as a whole, you should try to integrate all those applications with Cloud App Security. 

Once you've started integrating and planning ahead what applications are needed to be monitored first, start integrating those applications and monitoring them. Slowly, integration after integration, all the monitoring will start happening.

Once the integration for those applications has happened, you should go ahead and start implementing what kind of policies you want. If you want activity monitoring policies, then you should start creating those activity monitoring policies. Let's say you want to apply DLP policies for third-party applications. You will need to reach out to those different teams who'll be able to give you better answers as to how to approach the data that is being shared or being uploaded from those applications to any other applications.

Based on that, create those policies in Cloud App Security. The correct and the right approach is to use the network appliances that you have in your organization. Once you have identified that information, you can go ahead and start implementing the Cloud App Security and start integrating those network appliances and those applications with Cloud App Security.

Overall, I would rate the solution at an eight out of ten.

We use it for security alerts for any possible trouble for users. 

In terms of deployment, we have on-prem servers for now for one of the customers. We also have several customers on the Azure cloud.

I like the web GUI/the management interface. I also like the security of Microsoft. As compared to other manufacturers, it's less complex and easy to understand and work with.

There are some features, such as user navigation content filtering, that are disabled by default, and it probably makes sense to enable them by default.

I have been using this solution for about six months. 

It is stable.

It is scalable. We have 100 licenses for one company, and we probably have 1,000 licenses for another company.

I haven't used it yet.

The customer with 100 licenses used Sophos EDR. Microsoft Defender is more manageable. Sophos EDR is not a bad product. It is a complete product, but the Microsoft Defender is better.

It was more or less straightforward. 

It was implemented in-house.

It is a little bit expensive. When you want to have the complete package with Office 365, Defender, and everything else, it is expensive.

My advice would be to try it first and compare it with other solutions.

I would rate it an eight out of ten.

I used to deploy it in the customer's environment and set the requirements. It's used for blocking downloads, for example, and is a security feature for data centers.

The solution is helping a lot. We get a lot of very detailed reporting on security that really shows what users are doing, including what they've opened, what else they're sharing, downloading, viewing, et cetera, as well as when they are logging in. It's a very detailed activity and reporting of my units.

The file policy and activity policy are very useful aspects of the solution.

I can get information, for example, data location, IP address, et cetera. I use it for getting information about what's happening in my environment with certain files. I can see, for example, which user is sharing files externally, and if they're downloading or might be downloading, the documents on their personal device, a corporate device, or if they are sharing any folders with the outside world.

The initial setup is straightforward.

The general usability of the solution is very straightforward.

We've had an issue where an in-session policy was not working. I want them to enhance the in-session policy. It's something I came across while adding the application into MCAS as I wanted to apply some MCAS policies on those applications.

I've been using the solution for about five years now. 

The solution is 99.99% stable.

The solution is extremely scalable. 

I've handled technical support for my customers. 

I've only really worked with this solution. 

The initial setup is straightforward. I already have experience putting the solution into place and therefore I'm pretty adept at setting it up. The implementation simply requires understanding how the customer wants to use it and what they want to monitor. 

It's an ongoing deployment and I've been deploying the solution for almost six years now. 

I basically use authority to integrate all users and exchanges together. We have basically a Microsoft-oriented system.

When I deployed it, I applied it to around 4,000 users. I indirectly did it myself and it took around one month for me to integrate everything and to meet those policies to ensure they were in line and working as to my expectations and that I was getting the expected results that I wanted.

You only need one person to handle the deployment. Maybe two people.

We do not need the assistance of an integrator or consultant. 

I'm not acquainted with the licensing and pricing of the solution. 

I did not evaluate other options previously. 

I don't have a business relationship with Microsoft. I deploy the solution and I am managing MCAS for customers.

If a person has an Office-specific environment and they are looking for a solution, this is a good option. It's a good native application. Even if they were in a different cloud, I'd advise migration to a Microsoft environment. 

I'd rate the solution an eight out of ten.

They were testing Microsoft Defender and performing some checks with Microsoft Defender. On the Microsoft side of the same security cloud app, I believe.

We have a complete portfolio of election solutions. These election solutions, in general, require a high level of security. There are preparations to have within them, such as cloud apps or websites, or even an off-premise or on-premise type of solution. As a result, we must have both types of services and products in order to secure them. For example, we used the Microsoft denial-of-service attack. It's a software subscription service from Asia that you get for a set period of time.

If you are running a live elections operation, you should seriously consider using such a service from them because it is extremely reliable. It essentially protects your entire environment. So you wouldn't be too concerned about someone hacking into your environment or anything because you need to have results that you should be publishing. That is when having a security system becomes extremely important for you. That's on the app side of things, then, on the web, we publish these results. You must also have a system that will never fail due to an attack. That's also one of the things we usually think about when we have an election operation going on.

The most valuable feature of this solution is its monitoring. The monitoring of the application. 

Integration is simple, and you can monitor your applications at the enterprise level. As a result, you can have a holistic view of all applications and their statuses. 

It's very robust and it's very good.

The capabilities are very good. It has a lot of features in it, which is why many people recommend it.

It's not the cheapest. I believe it can be more reasonably priced. 

Sometimes the support is actually lacking. But we are talking about Microsoft.

I have been doing the testing for the past six or eight months.

Because it is a cloud-based solution, I believe that versioning is not a critical factor to consider.

Microsoft Defender for Cloud Apps is a stable product.

Microsoft Defender for Cloud Apps is scalable.

Sometimes you don't get to the appropriate support channel from the start. When you open a ticket, you don't always get what you're looking for right away. We tend to get stuck in loops or go from one support guy to the next until we escalate. That happens quite frequently. I believe that this is one of the areas that should be looked into.

We have an in-house ABAP development team that works on ABT software. I have heard the technical team conducting this evaluation, but I'm not sure which SAP application they're testing.

The price could be better and should be reconsidered.

We're evaluating Microsoft. We're also looking into SAPs, and other options are being considered at the moment.

From what I've seen, it's a good product. We occasionally encounter some, inefficiencies in its performance. But not all of the time, because our country has a lot of internet problems. As a result, the synchronization side tends to disconnect from time to time. So whenever we get disconnected, it causes some problems. You have to have a good connection after all because it is a cloud service, you must have a good internet connection in order to connect to it. We believe it is one of the best on the market. I believe it is a good option for anyone to use. But, once again, there are other players in the mix, which is why we are always doing some benchmarking and continuing with trials for other solutions.

I would rate Microsoft Defender for Cloud Apps an eight out of ten.