---
name: Defender for Cloud Apps Policy Coverage Audit
description: Audits the Microsoft Defender for Cloud Apps policy catalogue for gaps in discovery, access, session, and anomaly-detection coverage across sanctioned and unsanctioned cloud applications.
---

# Defender for Cloud Apps Policy Coverage Audit

> **TL;DR:** This skill inventories all active Microsoft Defender for Cloud Apps policies, identifies uncovered risk categories — shadow IT, risky OAuth apps, session-control gaps, and anomaly-detection blind spots — and produces a prioritised remediation table for the cloud security team.

## What does the Defender for Cloud Apps policy coverage audit examine?

Microsoft Defender for Cloud Apps (MDCA) governs SaaS application risk through four policy types: access policies, session policies, app discovery policies, and anomaly detection policies. Organisations that deploy MDCA without a structured policy review often have significant blind spots — discovery policies that miss generative AI apps, no session controls for regulated SaaS applications, or anomaly policies left at default severity without tuning. This skill audits the full MDCA policy catalogue, maps each policy to the risk category it addresses, identifies uncovered categories, and benchmarks coverage against Microsoft's recommended MDCA baseline configuration. It is an essential prerequisite for a Conditional Access App Control deployment and for IRAP evidence of network segmentation and application-layer controls.

## When should you run this skill?

- "Audit our Defender for Cloud Apps policy coverage"
- "What MDCA policies are we missing?"
- "Review cloud app security controls before an IRAP assessment"
- "Identify gaps in our CASB coverage"
- "Check whether our SaaS session controls are configured"

## How this skill works, step by step

1. Open the Microsoft Defender portal → Cloud Apps → Policies → Policy management
2. Export the full policy list with name, type, severity, enabled/disabled status, and last triggered date
3. Group policies by type: Access, Session, App discovery, Anomaly detection, OAuth app, File
4. For each type, check coverage against the MDCA baseline:
   - App discovery: covers generative AI category? Covers cloud storage, collaboration, code repositories?
   - OAuth app: governance policy enabled with auto-revoke for high-severity apps?
   - Session policies: at least one policy enforcing download-block or real-time DLP for regulated apps?
   - Anomaly detection: all built-in policies enabled? Custom thresholds set for high-sensitivity apps?
   - Access policies: BYOD or unmanaged-device access-block policies active?
5. Flag any policy that has never triggered (may indicate a configuration error or zero coverage)
6. Score coverage per category: Full (≥ 2 policies, all enabled, triggered in 90 days), Partial (1 policy or disabled), None (no policy)
7. Produce the table and summary below

## Output format

| Policy Category | Active Policies | Last Triggered | Coverage Score | Gap | Recommended Action |
| --- | --- | --- | --- | --- | --- |
| Generative AI discovery | 1 | 2026-05-14 | Partial | No block policy for high-risk AI apps | Add block policy for Taboola, unapproved LLMs |
| Session controls | 0 | Never | None | No session policy for any app | Deploy session policy for Exchange Online and SharePoint via CAAC |

Summary:

- Total MDCA policies: N
- Enabled: N
- Never triggered: N
- Coverage: Full N categories, Partial N, None N
- Critical gaps: N

## Scope and safety

Read-only by default. This skill does NOT:

- Create, modify, or delete MDCA policies
- Block or unsanction applications
- Apply Conditional Access App Control to any application

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Defender for Cloud Apps policy management | Microsoft Defender for Cloud Apps (included in Microsoft 365 E5 or E5 Security) |
| Session policy and CAAC deployment (remediation step only) | Microsoft Entra ID P1 + Defender for Cloud Apps |

### Least-privilege roles

- Cloud App Security Administrator (read full MDCA policy catalogue and activity)
- Security Reader (read-only review of Defender portal policies)

### Microsoft Graph permissions (read-only)

- MDCA policy data is accessed through the Microsoft Defender portal (Cloud Apps) and the Defender for Cloud Apps REST API — not through Microsoft Graph
- `CloudApp-Discovery.Read.All` (MDCA API scope) — read cloud app discovery and policy data

## Sources and compliance

- [Microsoft Defender for Cloud Apps policy overview (Microsoft Learn)](https://learn.microsoft.com/en-us/defender-cloud-apps/control-cloud-apps-with-policies)
- [Recommended policies for Defender for Cloud Apps — Microsoft baseline](https://learn.microsoft.com/en-us/defender-cloud-apps/recommended-ca-policies)
- Supports Essential Eight ML2 evidence for Control 2 (application control) and Control 7 (user application hardening)
- Pair with MDCA OAuth App Governance and MDCA Session Controls Review for complete CASB coverage
- Output in Australian English