Hunting shadow IT with Defender for Cloud Apps

The finding

Among more than 200 cloud applications in use that nobody had sanctioned, one was a consumer file-sync service hosted outside the country with real upload volume behind it. In a regulated healthcare environment that is a data exfiltration path, whether or not anyone meant it that way. It was blocked at the proxy the same week.

Context

Microsoft Defender for Cloud Apps builds a cloud discovery inventory from firewall and proxy logs. The inventory existed. What did not exist was anyone working through it with a question sharper than “what is on this list.”

Method

The discovery data is queryable in Sentinel through the McasShadowItReporting table, which is faster to reason about than the portal for anything beyond a single app. The first pass ranked unsanctioned apps by risk score and upload volume, in the shape of this query, with column names generalized:

McasShadowItReporting
| where TimeGenerated > ago(30d)
| where AppTags !has "Sanctioned"
| summarize
    Uploaded = sum(UploadedBytes),
    Users = dcount(UserName),
    Score = any(AppScore)
  by AppName, AppCategory
| where Uploaded > 0
| order by Score asc, Uploaded desc

Low score plus non-trivial upload volume is the combination that matters. A risky app nobody sends data to is a policy problem. A risky app receiving data is an incident waiting for a name.

The second pass looked at the survivors one at a time: where the vendor is, where the data sits, what the compliance attestations say, and whether the users had a business reason.

Evidence

What it means

• The inventory is not the audit. Discovery tools produce a list; the audit is the question you ask of it. “Unsanctioned, low-scored, and receiving data” was the question that worked.
• Upload bytes are the signal. Sessions and users describe popularity. Bytes leaving describe risk.
• Blocking was the easy part. The harder follow-up was finding out why people reached for the app, and making sure the sanctioned alternative actually covered that need.