Listen to this Post
Introduction:
Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is a comprehensive Cloud Access Security Broker (CASB) solution that provides deep visibility, data protection, and threat detection across your entire SaaS ecosystem. As organizations rapidly adopt AI agents and hundreds of connected OAuth apps, the attack surface has expanded exponentially – making it critical to stay ahead of emerging threats like prompt injection, OAuth token abuse, and shadow IT. Recent updates to Defender for Cloud Apps introduce powerful new capabilities, including AI Agent Protection, enhanced Salesforce connector with real-time event monitoring, and granular alert management that together redefine how security teams protect their cloud environments.
Learning Objectives:
- Understand how to enable and configure AI Agent Protection to detect and block prompt injection attacks in real time
- Learn to deploy the enhanced Salesforce connector with Real-Time Event Monitoring for OAuth threat detection
- Master the new alert suppression controls for unsanctioned app access to reduce noise and focus on critical threats
- Implement least-privilege principles using updated Workday connector permissions and unified RBAC
- Build custom KQL queries in Advanced Hunting to proactively hunt for AI agent and OAuth-related threats
You Should Know:
- AI Agent Protection – Your First Line of Defense Against Prompt Injection
AI agents are transforming business productivity, but they also introduce a new class of vulnerabilities. Prompt injection attacks – where malicious actors craft inputs that manipulate an AI agent into performing unintended actions – are becoming increasingly common. Microsoft Defender for Cloud Apps now offers AI Agent Protection (preview since November 2025) that automatically discovers AI agents created in Microsoft Copilot Studio and Azure AI Foundry, collects audit logs, and monitors for suspicious activity.
What this does: The real-time protection capability automatically blocks an agent’s response during runtime if it detects suspicious behavior such as a prompt injection attack. Security teams receive a detailed alert in the Microsoft Defender portal when this happens. For Azure AI Foundry agents, Defender monitors for misconfigurations and vulnerabilities, identifies potential attack paths, and delivers security recommendations through Security Exposure Management.
How to use it:
Step 1 – Enable AI Agent Protection:
- Navigate to the Microsoft Defender portal (security.microsoft.com)
- Go to Settings > Cloud Apps > AI Agent Protection
- Toggle the feature to On for your tenant
Step 2 – Configure Discovery and Monitoring:
- Under Discovery settings, select which AI agent sources to monitor (Copilot Studio, Azure AI Foundry, or both)
- Define audit log collection parameters – ensure your agents are configured to emit audit logs to Defender
Step 3 – Set Up Real-Time Blocking Rules:
- Navigate to Policies > Threat Detection > AI Agent Protection
- Create a new policy with the condition: “Prompt injection detected”
- Set the action to “Block agent response” and configure the alert severity (High recommended)
- Assign the policy to relevant agent workloads
Step 4 – Build Custom KQL Queries for Proactive Hunting:
For agents built with Copilot Studio, Defender ingests data into Advanced Hunting. Use the following KQL query template to hunt for suspicious agent interactions:
// Hunt for potential prompt injection attempts
CloudAppEvents
| where Timestamp > ago(7d)
| where Application contains "CopilotStudio" or Application contains "AzureAI"
| where ActionType in ("AgentQuery", "AgentResponse")
| where RawEventData contains "inject" or RawEventData contains "ignore_previous"
| extend PromptText = tostring(RawEventData.Prompt)
| extend ResponseText = tostring(RawEventData.Response)
| project Timestamp, AccountUpn, Application, PromptText, ResponseText, RawEventData
| sort by Timestamp desc
Step 5 – Respond to Alerts:
- When an alert is triggered, review the Incident in the Microsoft Defender XDR incidents experience
- The dedicated agent entity provides context on the agent, the user, and the injection attempt
- Use the Investigate button to pivot to related activities and determine if the attempt was successful
- Enhanced Salesforce Connector – Real-Time OAuth Threat Detection
Salesforce environments are prime targets for attackers who abuse OAuth tokens, connected apps, and sessions – often bypassing multi-factor authentication entirely. The enhanced Salesforce connector (preview June 2026) ingests Salesforce Real-Time Event Monitoring data to detect identity and OAuth threats with lower latency.
What this does: The connector ingests event data within minutes, improving detection coverage for OAuth abuse, session hijacking, credential stuffing, and anomalous API activity. It also extends OAuth app governance to Salesforce Connected Apps and External Client Apps (ECAs), allowing you to review permissions granted to each OAuth app.
How to use it:
Step 1 – Enable Real-Time Event Monitoring in Salesforce:
– Log in to your Salesforce console as an administrator
– Navigate to Setup > Event Manager
– Configure data storage for the following relevant events:
– `LoginEvent`
– `LogoutEvent`
– `ApiEvent`
– `OAuthTokenEvent`
– `SessionHijackingEvent`
– Enable Real-Time Event Monitoring and save the configuration
Step 2 – Configure the Salesforce Connector in Defender:
– In the Microsoft Defender portal, go to Settings > Cloud Apps > Connected Apps
– Select Salesforce and click Edit
– Under Data collection, enable Real-Time Event Monitoring
– Provide your Salesforce instance URL and OAuth credentials with the necessary scopes
Step 3 – Review OAuth App Governance:
- Navigate to App governance > OAuth apps in the Defender portal
- Filter by Salesforce to see all Connected Apps and ECAs
- Review the Highly privileged apps and Unused apps insights – these represent your highest-risk OAuth applications
- For any app with excessive permissions, use the Revoke or Restrict actions
Step 4 – Create Threat Detection Policies:
- Go to Policies > Threat Detection
- Create a new policy for Salesforce with conditions like:
- “OAuth token generated from anomalous IP”
- “Multiple failed API calls followed by successful OAuth token use”
- “Session hijacking event detected”
- Set actions to Alert and optionally Suspend user or Revoke tokens
- Alert Management – Suppress the Noise, Focus on the Signal
Starting in May 2026, you can disable informational alerts generated when users access unsanctioned apps. This is a game-changer for SOC teams drowning in alert fatigue.
What this does: A new “Generate alert for blocked app access” toggle in the Microsoft Defender for Endpoint settings lets you suppress informational alerts while keeping the blocking enforcement active. This is useful if the volume of informational alerts creates noise in your alert queue without providing actionable intelligence.
How to use it:
Step 1 – Access the Setting:
- Navigate to the Microsoft Defender portal
- Go to Settings > Endpoints > Advanced features (or Settings > Cloud Apps > Unsanctioned apps depending on your portal version)
Step 2 – Locate the Toggle:
- Find the “Generate alert for blocked app access” toggle
- This setting controls whether informational alerts are generated when a user attempts to access an unsanctioned app
Step 3 – Disable Informational Alerts:
- Set the toggle to Off to suppress informational alerts
- The blocking enforcement remains active – users will still be blocked from accessing unsanctioned apps, but your SOC team won’t receive a low-severity alert for every attempt
Step 4 – Monitor Blocking Activity:
- To verify that blocking is still working, check the Cloud Discovery dashboard
- Filter by Blocked apps to see which apps are being blocked and how many attempts occur
- Use the following KQL query to monitor blocked access without the alert noise:
// Monitor unsanctioned app access attempts (without informational alerts) CloudAppEvents | where Timestamp > ago(24h) | where ActionType == "BlockedAppAccess" | extend AppName = tostring(RawEventData.AppName) | extend User = tostring(RawEventData.UserPrincipalName) | project Timestamp, User, AppName, BlockReason = RawEventData.Reason | sort by Timestamp desc
- Unified RBAC and Least-Privilege Permissions – Centralize Access Control
In December 2025, Microsoft Defender for Cloud Apps permissions were integrated with Microsoft Defender unified RBAC. This centralizes permission management across all Microsoft Defender workloads from a single configuration point.
What this does: You can now activate the Defender for Cloud Apps workload through the unified RBAC settings, eliminating the need to manage permissions separately in multiple portals. Additionally, the Workday connector was updated to require only “View” permissions, removing the unnecessary “Change” permission to better satisfy the principle of least privilege.
How to use it:
Step 1 – Enable Unified RBAC for Defender for Cloud Apps:
– In the Microsoft Defender portal, go to Permissions > Roles
– Select Unified RBAC (if not already enabled)
– Under Workloads, toggle Defender for Cloud Apps to Active
Step 2 – Assign Roles and Permissions:
- Create or modify a role with the Defender for Cloud Apps workload enabled
- Assign granular permissions such as:
- View alerts and incidents
- Manage policies
- Manage connected apps
- View and manage app governance
- Assign the role to specific security teams or individual users
Step 3 – Update Workday Connector Permissions:
- If you use the Workday connector, log in to your Workday account
- Review the current permissions granted to the Defender connector
- Remove the “Change” permission – the connector now only requires “View” permissions to function
- Test the connector after removing permissions to ensure it still works correctly
Step 4 – Audit Existing Permissions:
- Use the following PowerShell command (for Azure AD/Entra ID) to audit which users have access to Defender for Cloud Apps:
Connect to Microsoft Graph
Connect-MgGraph -Scopes "RoleManagement.Read.All", "User.Read.All"
Get all directory roles and their members
Get-MgDirectoryRole | ForEach-Object {
$role = $_
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
[bash]@{
RoleName = $role.DisplayName
Members = ($members.AdditionalProperties.userPrincipalName -join ", ")
}
} | Format-Table -AutoSize
- Secure Score Category Updates and Unused App Insights
In March 2026, Microsoft updated the Secure Score category calculations – some security recommendations previously categorized under Cloud Apps are now grouped under the Identity category. The total Secure Score remains unchanged, but individual identity and app scores may shift. Additionally, the unused app insights feature (preview December 2025) helps you identify and manage unused Microsoft 365-connected OAuth apps – which represent a security risk because their credentials may be compromised without anyone noticing.
What this does: Unused apps are a silent risk vector. Attackers often target dormant OAuth apps because they are less likely to be monitored. The unused app insights feature surfaces these apps and allows you to enforce policy-based governance.
How to use it:
Step 1 – Review Unused App Insights:
- Navigate to App governance > Unused apps
- Review the list of OAuth apps that have not been used in the past 90 days (configurable)
- Pay special attention to apps with High privilege levels
Step 2 – Enforce Policy-Based Governance:
- Go to Policies > App governance
- Create a new policy with the condition: “App is unused for more than 90 days”
- Set the action to “Revoke access” or “Notify admin”
- Apply the policy to all applicable apps
Step 3 – Investigate Using Advanced Hunting:
Use this KQL query to investigate OAuth app activity:
// Investigate OAuth app usage and identify unused apps CloudAppEvents | where Timestamp > ago(90d) | where Application contains "OAuth" | summarize LastUsed = max(Timestamp), TotalEvents = count() by AppName = tostring(RawEventData.AppName), AppId = tostring(RawEventData.AppId) | where TotalEvents < 5 // Low activity threshold | project AppName, AppId, LastUsed, TotalEvents | sort by LastUsed asc
Step 4 – Monitor Secure Score Changes:
- After the category updates, review your Secure Score dashboard
- Note that your Identity score may have decreased while your Cloud Apps score increased – this is expected
- Focus on remediating recommendations in both categories to improve your overall security posture
What Undercode Say:
- Key Takeaway 1: AI Agent Protection is not just a nice-to-have – it’s a necessity. With prompt injection attacks becoming the new SQL injection for the AI era, enabling real-time blocking and proactive hunting is critical for any organization deploying AI agents.
- Key Takeaway 2: The enhanced Salesforce connector with Real-Time Event Monitoring shifts OAuth threat detection from reactive to proactive. By ingesting events within minutes instead of hours, security teams can now detect and respond to OAuth abuse, session hijacking, and credential stuffing in near real-time.
Analysis:
The May 2026 updates to Microsoft Defender for Cloud Apps represent a strategic shift toward proactive, intelligence-driven security. The ability to suppress informational alerts for unsanctioned app access acknowledges a hard truth in cybersecurity: alert fatigue is a real threat to operational efficiency. By giving SOC teams the power to filter out noise while keeping enforcement active, Microsoft is addressing a long-standing pain point. The integration of unified RBAC and the Workday connector’s least-privilege update further signal a maturation of the platform – moving from a collection of security tools to a cohesive, policy-driven security fabric. For security architects, the message is clear: Defender for Cloud Apps is no longer just a CASB; it’s becoming the central nervous system for SaaS and AI security.
Prediction:
- +1 The introduction of AI Agent Protection will catalyze a new wave of AI-specific security policies across enterprises, leading to the emergence of “AI Security Analysts” as a dedicated role within SOC teams.
- +1 Real-time event monitoring for Salesforce and other major SaaS platforms will become the industry standard, forcing competitors like Palo Alto Networks and Cisco to accelerate their own real-time detection capabilities.
- -1 Organizations that fail to enable the new alert suppression controls will continue to suffer from alert fatigue, potentially missing critical threats buried under a mountain of low-severity informational alerts.
- +1 The integration of Defender for Cloud Apps permissions into unified RBAC will streamline security operations, reducing the administrative overhead of managing permissions across multiple portals and decreasing the risk of misconfigured access controls.
- -1 As AI agents become more prevalent, attackers will increasingly focus on prompt injection and data exfiltration through AI channels – organizations that delay implementing AI Agent Protection will be prime targets for these emerging attack vectors.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Mmihalos Microsoftsecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
