Microsoft Cloud App Security

Microsoft Cloud App Security (MCAS) fits in a category of services called cloud access security brokers (CASB). It is designed to help organizations discover the cloud applications accessed by their users and offers management and data loss prevention capabilities in certain scenarios.

The primary MCAS capabilities are as follows:

• Discovery, in which MCAS finds cloud applications that are in use and may begin controlling them
• Information protection, in which MCAS can protect documents before they are copied to or from controlled cloud applications
• Threat detection, in which MCAS attempts to detect application use that is out of the ordinary and potentially control how users access the cloud applications.

Sensitivity labeling can be integrated with MCAS information protection, enabling automatic encryption of documents before users share them with external cloud applications.            

Some discovery capabilities offered by MCAS are included with Azure Active Directory (AAD) Premium P1, a component of Microsoft 365 E3. However, the full MCAS service is required for information protection or threat detection.