Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
defender_ensure_mcas_is_enabledProvider: Azure
Service:
defenderSeverity: MEDIUM
Categories:
logging, forensics-readyResource type:
microsoft.security/pricingsWhat this check verifies
Subscription settings contain theMCAS integration for Microsoft Defender for Cloud Apps, and the setting is enabled.
Risk
Missing integration leaves Defender for Cloud blind to SaaS context, weakening correlation of control-plane activity with app usage. Attackers can hide data exfiltration via cloud apps, abuse OAuth grants, or mask unauthorized ARM changes-impacting confidentiality and integrity and slowing incident response.Recommendation
Enable and keep theMCAS integration consistent across subscriptions.
- Apply least privilege to integration roles and data access
- Use policy to enforce the setting and prevent drift
- Practice defense in depth by correlating SaaS and cloud signals
- Review licensing and validate alert coverage regularly
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-in/azure/defender-for-cloud/defender-for-cloud-introduction#secure-cloud-applications
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/SecurityCenter/defender-cloud-apps-integration.html#
- https://learn.microsoft.com/en-us/answers/questions/2045272/integrating-microsoft-defender-for-cloud-apps-with
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = defender_ensure_mcas_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks