Check ID: defender_ensure_mcas_is_enabled
Provider: Azure
Service: defender
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: microsoft.security/pricings

What this check verifies

Subscription settings contain the MCAS integration for Microsoft Defender for Cloud Apps, and the setting is enabled.

Risk

Missing integration leaves Defender for Cloud blind to SaaS context, weakening correlation of control-plane activity with app usage. Attackers can hide data exfiltration via cloud apps, abuse OAuth grants, or mask unauthorized ARM changes-impacting confidentiality and integrity and slowing incident response.

Recommendation

Enable and keep the MCAS integration consistent across subscriptions.
  • Apply least privilege to integration roles and data access
  • Use policy to enforce the setting and prevent drift
  • Practice defense in depth by correlating SaaS and cloud signals
  • Review licensing and validate alert coverage regularly

Remediation

az rest --method PUT --uri https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/settings/MCAS?api-version=2021-06-01 --body '{"properties":{"enabled":true}}'

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_mcas_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks