App Governance Anomaly Detection Alerts
Cloud and workloads
The article now states that, as of October 15, 2026, two EWS-based detections are marked Retired and no longer generate alerts.
Product
Microsoft Defender for Cloud Apps
Track documentation and Message Center changes for Microsoft Defender for Cloud Apps.
Microsoft Learn documentation ↗Latest Microsoft Defender for Cloud Apps changes
Caac Known Issues
Cloud and workloads
The documentation now explains that protection applies across tenants within the same Microsoft Edge work-profile session. Separate Edge work profiles provide separate session enforcement between tenants.
Migrate File Policies To Purview
Cloud and workloads
The guide now lists auto-labeling migration for SharePoint and OneDrive, plus DLP file-policy migration for Google Workspace, Box, Dropbox, and Salesforce. Previously, it listed only SharePoint and OneDrive DLP migration as supported.
Migrate File Policies To Purview
Cloud and workloads
Two authoring metadata link entries were updated, but their URLs remain unchanged.
Release Notes
Cloud and workloads
Starting October 15, 2026, the Defender for Cloud Apps integration with Identity inventory will move from opt-in to automatic enablement for eligible tenants that do not use the listed excluded configurations.
Manage Admins
Cloud and workloads
App/instance admin and User group admin role assignments can no longer be used in new configurations. Existing configurations remain supported.
App Governance App Policies Create
Cloud and workloads
The documentation adds Risk management templates, including New high risk app and Risk score policies with customizable risk thresholds. It also updates monitoring guidance and the navigation path.
App Governance Manage App Governance
Cloud and workloads
The page updates wording from app compliance to app security, renames the sharing section, and says administrators can review app details, aggregated data, and permission usage before viewing more information in Entra ID.
App Governance Trial User Guide
Cloud and workloads
The guide now describes itself as a quickstart and changes the step from assessing app compliance posture to assessing security posture, including an updated link. Author and publication metadata were also refreshed.
App Governance Visibility Insights Overview
Cloud and workloads
The app categories documentation now includes Risky apps—apps with a high risk score—and adds Risk score. Minor wording was also clarified.
App Governance Visibility Insights View Apps
Cloud and workloads
The documentation now describes risk scores, last-used dates, and a Used by AI Agents (Preview) field. Salesforce inventory is also documented as including Connected Apps and External Client Apps.
Application inventory - Microsoft Defender for Cloud Apps | Microsoft Learn
Cloud and workloads
The article now describes app risk scores, privilege levels, publisher information, and usage, clarifies SaaS insight definitions, and links to filtering and query guidance.
Secure OAuth apps with Microsoft Entra RBAC roles - Microsoft Defender for Cloud Apps | Microsoft Learn
Cloud and workloads
Adds instructions for using Defender for Cloud Apps app governance to filter, investigate, and assess Microsoft Entra RBAC roles assigned directly to service principals, including role permissions, privilege levels, and risk signals.
Working With The Regex Engine
Cloud and workloads
The article now more clearly explains that it covers supported RegEx syntax, known limitations, and examples for building expressions in content inspection and file policies.
Add custom apps to cloud discovery
Cloud and workloads
The documentation now highlights that using **Remove all tags** removes the **Custom app** tag, while retaining instructions for filtering custom apps by that tag. Wording around custom apps was also clarified.
Advanced log collector management | Microsoft Defender for Cloud Apps
Cloud and workloads
The page now includes clearer advanced-options setup guidance, prerequisites and deployment references, container-preserving token renewal instructions, updated Defender portal terminology, and expanded Syslog troubleshooting guidance.
Anomaly detection policies in Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now explains the heuristic and machine-learning baselines, clarifies the seven-day learning period and dynamic threat detection model, updates navigation and terminology, and lists activity by terminated users as a detection.
Apps Manual Onboarding With Microsoft Entra Id
Cloud and workloads
The article now advises verifying licenses, administrative access, and app configuration before onboarding. It also specifies that catalog applications appear in the Connected Apps table on the Conditional Access App Control page.
Cloud app catalog and risk scores | Microsoft Defender for Cloud Apps
Cloud and workloads
The article updates its date and metadata, replaces “Microsoft Defender XDR” with “Defender portal,” and clarifies wording about app scoring, parameter weights, and follow-up guidance.
Cloud discovery data anonymization
Cloud and workloads
The page date and authoring metadata were updated. Wording now identifies Defender for Cloud Apps as generating reports from anonymized data and states that each username resolution action is recorded in the portal’s Audit log.
Cloud discovery policies
Cloud and workloads
The article now explains that selecting “Tag app as unsanctioned” automatically blocks access when the policy matches, and defines app tags as labels for filtering and targeting discovered apps.
Common threat protection policies | Microsoft Defender for Cloud Apps
Cloud and workloads
The page now provides clearer descriptions of unfamiliar locations and impossible travel detections, ransomware coverage, governance actions, and Microsoft Threat Intelligence.
Commonly used information protection policies | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now covers file and session policy scenarios, explains when the Data Classification Service inspects file content, and clarifies steps for sensitivity-label filters, governance actions, and GDPR-related data types.
Conditional Access app control known limitations | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now documents that Teams or Teams-integrated functionality launched from a proxied Gmail session might not be supported. It recommends accessing Teams directly instead.
Configure activity monitoring to protect user privacy
Cloud and workloads
The article now provides expanded guidance for configuring privacy groups, granting admins permission to view private activities, and viewing those activities in the activity log. Wording, headings, image descriptions, anchors, and audit-log explanations were also refined.
Configure admin access | Microsoft Defender for Cloud Apps
Cloud and workloads
The guide now presents prerequisites for accessing and editing Manage admin access, clarifies steps for adding admins and MSSPs, and states that Microsoft Entra roles already granting Full access cannot be overridden.
Configure automatic log upload for continuous reports in Microsoft Defender for Cloud Apps
Cloud and workloads
The page title now identifies Defender for Cloud Apps, removal steps explicitly refer to the collector container, and the deployment section directs administrators to choose a guide for their platform.
Configure automatic log upload using Docker in Azure
Cloud and workloads
The Ubuntu deployment article now more clearly documents the root-access prerequisite, collector configuration steps, status verification, and related wording and navigation updates.
Configure automatic log upload using on-premises Docker on Linux | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now explains that administrators should stop and remove the existing Docker container before redeploying or replacing a log collector, with a warning that removal is permanent. It also updates wording, image descriptions, and metadata.
Configure automatic log upload using on-premises Docker on Windows | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation clarifies Windows Docker-based deployment steps, including rerunning LogCollectorInstaller.ps1, the Docker Desktop WSL 2 message, and separate Syslog and FTP forwarding guidance. Screenshot descriptions and prerequisite wording were also updated.
Configure automatic log upload using on-premises Podman on Linux | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now explains continuous log uploads to Cloud Discovery, uses a clearer setup heading, and clarifies that administrators should consider container, firewall, and syslog changes when checking log status.
Configure Defender for Cloud Apps user email notifications
Cloud and workloads
The page now describes customizing end-user email notifications with HTML templates, branding, titles, and content placeholders, and notes supported notification types and differences from admin notifications. It also updates the sample-template wording and page metadata.
Connect apps with API connectors in Microsoft Defender for Cloud Apps
Developer and API
The article now more clearly covers supported connectors, scanning and data collection, connector management, prerequisites, and connector-specific guides. Wording, headings, navigation, and metadata were also updated.
Connect Citrix ShareFile | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now links to prerequisites, adds context about protecting the ShareFile environment, and provides clearer steps for creating API keys and configuring the connector.
Connect Zoom | Microsoft Defender for Cloud Apps
Cloud and workloads
Updated metadata and introductory wording, expanded the related-information reference to SaaS security posture management and Microsoft Secure Score, and added a lead-in to the connection steps.
Control cloud apps with policies
Cloud and workloads
Updated metadata, link labels, wording, screenshot descriptions, and the Policies overview report heading and anchor.
Create access policies | Microsoft Defender for Cloud Apps
Cloud and workloads
Updated the publication metadata, clarified the session policy guidance and link title, improved the screenshot description, and added a Get help heading.
Create activity policies | Microsoft Defender for Cloud Apps
Cloud and workloads
The page now uses a clearer custom-alerts heading and explains that alerts apply when policy-defined activities are detected. It also clarifies that the affected user can be suspended and adds a related-policy reference lead-in.
Create and manage OAuth app policies with app governance | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now uses clearer headings and navigation anchors, improves wording and screenshot text, and adds steps for editing user-defined policies plus a link to investigate generated alerts.
Create cloud discovery policies
Cloud and workloads
The article now includes expanded introductory guidance, clearer wording for saved organization-wide alert defaults, updated metadata, and more descriptive screenshot alt text.
Create policies to control OAuth apps
Cloud and workloads
The article now explains creating and managing app permission policies to control OAuth app behavior, including notifications, permission investigation, and approval or banning. It also notes that OAuth app policies trigger alerts only for policies authorized by users in the tenant.
Create snapshot cloud discovery reports
Cloud and workloads
The article now explicitly describes creating a snapshot report by manually uploading firewall or proxy traffic logs to validate the log format and gain initial cloud app visibility before using the automatic log collector.
Deploy conditional access app control for any web app using AD FS
Architecture and deployment
The instructions now specify using the AD FS SingleSignOnService Location from the federation metadata and explicitly require a Microsoft Defender for Cloud Apps license. They also clarify which values are needed when configuring the relying party trust.
Deploy conditional access app control for any web app using Okta
Architecture and deployment
The article updates its metadata and clarifies setup instructions, including where the IdP SSO URL, signing certificate, Defender for Cloud Apps SSO URL, and attribute values are used in later steps.
Deploy conditional access app control for any web app using PingOne
Architecture and deployment
The page now states that the Defender for Cloud Apps SAML certificate is valid for one year and requires a new certificate after expiration.
Discovered app filters and queries | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now describes using basic and advanced filters on the Discovered apps page, including filtering by risk score, category, compliance, and usage. App-tag wording and document metadata were also updated.
DLP content inspection
Cloud and workloads
The article now identifies “Grant permission” as one-time administrator consent, clarifies that content and metadata are inspected by default, and adds guidance for configuring file policies that inspect protected files.
Ems Cloud App Security Govt Service Byok
Cloud and workloads
The page now clarifies that enabling customer-managed data encryption is available only in the Microsoft Defender portal, updates screenshot descriptions, labels the disabling-encryption note as a warning, and improves the key-rotation section heading and anchor.
Enrich cloud discovery data with Microsoft Entra usernames
Cloud and workloads
The article now uses clearer terminology, adds prerequisite guidance, and includes a tip and updated screenshot description for the Microsoft Entra username enrichment option.
File policies in Microsoft Defender for Cloud Apps
Cloud and workloads
The article now uses clearer file-policy terminology, adds updated limitation structure and screenshot text, and directs administrators to Policies > Policy management in the Microsoft Defender portal to review violations.
Filter and query activities | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now explains activity filters, saved queries, investigations, and exports in more detail. It also identifies App connector and App connector analysis as Source filter options and updates screenshot descriptions and metadata.
Generic SIEM integration
Cloud and workloads
The documentation states that existing Defender for Cloud Apps SIEM agents continue functioning until November 2025. It also confirms that new SIEM agents cannot be configured and that Microsoft Sentinel agent integration remains supported in preview.
Get Started
Cloud and workloads
The getting-started guidance now directs Defender for Endpoint users to the Defender portal, rather than Microsoft Defender XDR, to turn on the required setting.
Govern discovered apps
Cloud and workloads
The article now requires a supported on-premises security appliance to be configured and available before importing a block script. It also clarifies unsanctioned-app blocking across integrations and governance-action precedence.
Govern discovered apps using Microsoft Defender for Endpoint
Cloud and workloads
The page now includes a requirements section, updated screenshots and setting names, clearer scoped-profile instructions, clarified Microsoft Defender for Business device-group behavior, and revised related-content navigation.
Governing connected apps
Cloud and workloads
The page now clarifies role restrictions, that malware governance actions apply only to connected apps, and that Microsoft Entra synchronization can revert the Suspend user or other affected governance actions. It also refines OAuth permission guidance and wording.
How to investigate anomaly detection alerts | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now uses clearer MITRE ATT&CK tactic terminology, names specific detections, and clarifies learning periods and B-TP examples for anomalous locations and impossible travel alerts.
Hunt for threats in app activities | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now states that queries return up to 1,000 results by default and can be edited to return up to 100,000 rows. Results exceeding 64 MB may be partial and trigger a notification; these limits do not apply to app governance.
Identity-managed devices with Conditional Access app control | Microsoft Defender for Cloud Apps
Identity protection
The article now distinguishes Microsoft Entra device conditions from client-certificate options and specifies uploading root or intermediate CA certificates before creating policies based on Device tag or Valid client certificate.
Import user groups from connected apps
Cloud and workloads
The page now uses a more specific heading and anchor for importing a user group from a connected app, and clarifies the Salesforce standard profiles link text. Documentation metadata was also updated.
In-browser protection with Microsoft Edge for Business | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now clarifies the suitcase indicator, states that Endpoint DLP takes priority when the same context and action overlap, and explains that users may switch browsers when policy or operating system compatibility prevents in-browser protection.
Integrate Microsoft Defender for Cloud Apps with external security solutions
Cloud and workloads
The article title and description now emphasize integrations with threat intelligence, MDM/MTD, and UEBA solutions. It also clarifies the UEBA and Microsoft Entra ID Protection context for risky-user policies and adds a support heading.
Integrate Microsoft Defender for Endpoint
Cloud and workloads
The page metadata was updated, and the integration section now introduces prerequisites and describes the integration’s capabilities more clearly.
Integrate Microsoft Purview sensitivity labels with Defender for Cloud Apps
Cloud and workloads
The article now more clearly describes using sensitivity labels to classify, protect, and investigate files, including sensitivity-label scans, direct file labeling, and automatic labeling policies. The title, metadata, and file-drawer screenshot description were also updated.
Integrate Microsoft Sentinel with Microsoft Defender for Cloud Apps
Cloud and workloads
The Microsoft Sentinel integration page now states that SIEM agents are deprecated and that the Microsoft Sentinel integration (Preview) remains supported. It also adds a dedicated integration section.
Integrate with Corrata
Cloud and workloads
The article now includes a pre-deployment licensing section and clearer deployment instructions, along with wording, image-description, metadata, and formatting updates.
Integrate with iboss
Cloud and workloads
The page adds a reminder to confirm required licenses, clarifies deployment instructions, updates the section heading, and improves the setup screenshot description.
Integrate with Microsoft Power Automate for custom alert automation
Incidents and response
The documentation now explicitly requires creating a Defender for Cloud Apps API token before creating playbooks and using that token in the connection’s authentication settings.
Integrate with Open Systems
Cloud and workloads
The page now includes a licensing prerequisite and introductory instructions for deploying the Defender for Cloud Apps and Open Systems integration. Metadata was also updated.
Integrate with Zscaler
Cloud and workloads
The article now explicitly describes prerequisites and deployment steps, and clarifies that unsanctioned apps are blocked according to settings in the Zscaler portal.
Investigate accounts from connected apps
Cloud and workloads
The article now explains how to view and use the Cloud application accounts inventory, investigate accounts, filter by account type, and take actions. It also updates headings, anchors, screenshot descriptions, and metadata.
Investigate activities in Microsoft Defender for Cloud Apps
Cloud and workloads
The article now focuses its description on investigating app activities, activity types, and event filters. It also updates screenshot text, adds anchors for user and IP address insights, and refreshes metadata.
Investigate activities using the API
Developer and API
The article now describes scanning and retrieving large volumes of activity data, clarifies pagination wording, and reorganizes the next-steps links under Related content.
Investigate apps discovered by Microsoft Defender for Endpoint | Microsoft Defender for Cloud Apps
Cloud and workloads
The article clarifies Cloud Discovery navigation, integration context, network-event descriptions, and unsanctioned-app investigation steps. Headings, portal terminology, metadata, and screenshot descriptions were also updated.
Investigate cloud app risks and suspicious activity
Cloud and workloads
The documentation now consistently refers to policy violations and clarifies that administrators should determine appropriate remediation steps after suspending a user.
Investigate Defender for Cloud Apps and Defender for Cloud behaviors with advanced hunting
Hunting and detection
The article now covers investigating behaviors from both Defender for Cloud Apps and Defender for Cloud. It documents the BehaviorInfo and BehaviorEntities tables, BehaviorId joins, and adds context for sample investigation queries.
Investigate OAuth app threat detection alerts with app governance | Microsoft Defender for Cloud Apps
Cloud and workloads
The guide now explicitly lists alert categories from Initial Access through Impact, clarifies discovery-alert descriptions, and streamlines links and remediation instructions.
Investigate OAuth application attack paths in Defender for Cloud Apps
Vulnerabilities and exposure
The Attack Paths documentation now warns that disabling an OAuth application can disrupt services and remove access for dependent users and services. It also updates headings, terminology, and page metadata.
Investigate predefined OAuth app policy alerts with app governance | Microsoft Defender for Cloud Apps
Cloud and workloads
The page now names three disabled policies, clarifies detection coverage for overprivileged and highly privileged apps, adds a sensitive-data access description, and updates a link title.
Learn about OAuth app threat detection and remediation
Cloud and workloads
The overview now says to use app governance with Defender for Cloud Apps in the Defender portal instead of Microsoft Defender XDR.
Manage IP address ranges using the API
Developer and API
The article now provides clearer coverage of Data Enrichment API operations, Python CSV synchronization, pagination using `nextQueryFilters`, deletion behavior, and Defender for Cloud Apps support.
Manage OAuth apps | Microsoft Defender for Cloud Apps
Cloud and workloads
The page now uses clearer wording for Microsoft Defender preview features, connected-app data permissions, and the green approved-app icon.
Microsoft 365 Security Center Defender Cloud Apps
Cloud and workloads
The page now says analysts hunt “in” all Microsoft Defender XDR workloads and refers to protecting cloud apps in Microsoft Defender. The support link remains unchanged.
Microsoft Data Classification Services integration
Cloud and workloads
The article title and terminology were refined, and the masking instruction now explicitly states that selecting the checkbox unmasks the last four characters of a match. Metadata was also updated.
Microsoft Defender for Cloud Apps policy templates
Cloud and workloads
The page now links “Microsoft Defender Portal” to https://security.microsoft.com and updates its metadata, including the date and authoring tag.
Migrate File Policies To Purview
Cloud and workloads
The documentation now describes a DLP to Purview migration tool, including prerequisites, supported SharePoint and OneDrive policies, migration steps, and unsupported scenarios. Existing file policies have a January 6, 2027 deadline for migration to maintain coverage.
Onboard non-Microsoft IdP catalog apps for Conditional Access app control | Microsoft Defender for Cloud Apps
Architecture and deployment
The procedure now more clearly explains that administrators should copy the SSO URL and attributes, then enter them in the IdP’s custom app configuration steps.
Onboard non-Microsoft IdP custom apps for Conditional Access app control | Microsoft Defender for Cloud Apps
Architecture and deployment
The procedure now refers to the Defender portal, points SSO configuration details to step 8, adds a “Before you begin” section, and formats the support link as a tip.
Protect your Amazon Web Services environment
Cloud and workloads
The Protect AWS page received clearer wording, a renamed section with an HTML anchor, updated connector API guidance, and minor credential wording changes. Page metadata was also updated.
Protect your Asana environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now more clearly explains connecting Asana through the App Connector API, configuring activity-monitoring policies, automating governance actions, and collecting the Asana access token and workspace ID.
Protect your Atlassian environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now documents a 1-year default API-key validity, recommends refreshing keys every six months, and adds an 8,000-events-per-minute limit alongside the 1,000-requests-per-minute limit. Connection steps and monitored Atlassian services are also clarified.
Protect your Azure environment
Cloud and workloads
The page now introduces the steps for connecting Azure to Defender for Cloud Apps, refreshes best-practice link wording, and updates its metadata.
Protect your Box environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The Box protection documentation now requires a Box Admin account or a fully privileged Co-Admin account for the connection.
Protect your Cisco Webex environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now expands IdP terminology, clarifies the Webex connection description, and specifies that the default event scan period is three months. Extending it requires a Cisco Webex Pro license and a support ticket.
Protect your DocuSign environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article updates headings, links, wording, and metadata, and now explicitly instructs administrators to sign in with a mapped DocuSign account that has Account Admin permissions before collecting connector values.
Protect your Dropbox environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now uses clearer wording for Dropbox risks, connector APIs, governance actions, and unauthenticated users, and adds sections on threats and best practices.
Protect your Egnyte environment (Preview) | Microsoft Defender for Cloud Apps
Cloud and workloads
The page received revised descriptions of Egnyte monitoring, governance actions, and App Connector setup, plus an introduction to connection requirements. Documentation metadata was also updated.
Protect your GitHub Enterprise environment | Microsoft Defender for Cloud Apps
Cloud and workloads
Updated the GitHub Enterprise Cloud section heading and anchor, clarified the connector setup step, refined best-practice wording, and refreshed the GitHub OAuth access link.
Protect your Google Cloud Platform environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The Defender for Cloud Apps GCP protection page was refreshed with clearer descriptions, an updated section anchor, and more explicit setup instructions for the service account email, Organization ID, and JSON private key file.
Protect your Google Workspace environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The page’s update date and authoring metadata were revised, while the OAuth scope list and scan-process guidance were synchronized.
Protect your Microsoft 365 environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article adds Microsoft Entra integration and connection-prerequisite guidance, refines threat-related wording, and clarifies that the service principal API must be enabled for Malware detection and response support. Logs may take 24–72 hours to arrive afterward.
Protect your Miro environment
Cloud and workloads
The article now uses a clearer prerequisites link, adds a named anchor, renames the “Main threats” section to “Main threats to your Miro environment,” and introduces a table of supported governance actions.
Protect your Mural environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now states that the Activity performed by terminated user policy requires Microsoft Entra ID as the identity provider and that Mural audit-log ingestion is delayed by 48 hours. It also includes wording, heading, and navigation updates.
Protect your NetDocuments environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article’s metadata and wording were updated, including guidance on activity visibility, unusual-behavior detection, governance actions, and Secure Score recommendations.
Protect your Okta environment | Microsoft Defender for Cloud Apps
Cloud and workloads
Updated the Okta integration article with clearer section headings, connection instructions, service-account and API-token guidance, support wording, and screenshot text.
Protect your OneLogin environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article was updated with a new section anchor, a clearer heading and introductory wording, and a prompt to review a prerequisite before connecting Defender for Cloud Apps to OneLogin.
Protect your Salesforce environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now distinguishes Salesforce Shield requirements for SSPM versus other integrations, and adds Salesforce and Event Manager setup steps before connecting Defender for Cloud Apps.
Protect your ServiceNow environment | Microsoft Defender for Cloud Apps
Vulnerabilities and exposure
The page adds optional instructions for creating a non-admin ServiceNow user with custom read ACLs and a shared role. It also clarifies 90-day token rotation and adds an Australia-specific Scope Restriction instruction.
Protect your Smartsheet | Microsoft Defender for Cloud Apps
Cloud and workloads
The page adds a prerequisite reminder, updates headings, and provides more descriptive text for Smartsheet setup screenshots. Documentation metadata was also updated.
Protect your Workday environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The page now links to prerequisites, clarifies the required Workday security-group permission, and explicitly lists the API values to enter during connector setup. Headings, anchors, and related links were also refined.
Protect your Workplace environment | Microsoft Defender for Cloud Apps
Cloud and workloads
The article was rewritten for clearer wording, updated to refer consistently to Workplace by Meta, added a threats introduction, and clarified API connector and Secure Score guidance. Its metadata and section anchor were also updated.
Protect your Zendesk | Microsoft Defender for Cloud Apps
Cloud and workloads
The article now refers to the Zendesk environment, adds navigation anchors, identifies OAuth credential creation in Zendesk for the connector, and clarifies the SaaS security posture management and rate-limit sections.
Release Notes
Cloud and workloads
Starting in August 2026, new Defender for Cloud Apps customers will have unified RBAC automatically enabled, providing centralized role and permission management across Microsoft Defender products.
Remediate OAuth app threats with app governance alerts
Cloud and workloads
The page now refers to the Defender portal Alerts and Incidents pages, clarifies which approval, ban, notification, and permission-revocation procedures apply to Salesforce and Google Workspace, and improves screenshot descriptions.
SaaS Security Initiative in Microsoft Defender XDR
Cloud and workloads
The article now emphasizes SSPM recommendations organized into 12 metrics, adds prerequisite guidance, and updates instructions for accessing, prioritizing, and tracking recommendations in the Defender portal.
SaaS Security Posture Management (SSPM) in Microsoft Defender for Cloud Apps
Vulnerabilities and exposure
The page description now explains SSPM assessment of SaaS configurations, recommendations in Microsoft Security Exposure Management, and OAuth application risk visibility. Screenshot wording and publication metadata were also updated.
Scope your Defender for Cloud Apps deployment by users and groups
Cloud and workloads
The documentation now clarifies that include rules exclude groups outside the included group, that scoping in the example rules does not affect other apps, and that the account-correlation workaround applies when account ID formats differ.
Secure OAuth apps accessing non-Graph APIs using app governance
Developer and API
The article now has an Overview section and revised wording explaining visibility into OAuth apps that access Microsoft Graph and other APIs. It also clarifies that the Permissions tab lists Graph and non-Graph API permissions.
Secure OAuth apps with app governance hygiene features | Microsoft Defender for Cloud Apps
Cloud and workloads
The documentation now uses clearer wording for finding unused apps and managing unused or expiring credentials, adds an example image of app hygiene policy conditions, and updates metadata.
Set up Microsoft Defender for Cloud Apps
Identity protection
The article was retitled and updated with clearer Microsoft Purview Information Protection setup ordering, an Identity Inventory irreversibility warning, refreshed links, and wording corrections.