docs(audit): Defender for Cloud Apps pattern catalog (closes #338)#368
Merged
Conversation
Twelfth domain audit under v3.4.0 umbrella (#326). Resolves spike #338. docs/audits/defender-for-cloud-apps.md catalogs 24 canonical patterns across 5 sub-domains (app connectors, OAuth app governance, Cloud Discovery, session policies, anomaly detection + alert policies). Surfaces a STARK COVERAGE ASYMMETRY: only 1 MDCA-specific check (DEFENDER-CLOUDAPPS-001 = "is MDCA enabled") versus 27 OAuth / app-governance checks in ENTRA-ENTAPP-* + ENTRA-CONSENT-* namespaces. The OAuth dimension that MDCA's spike covers is already strong at the Entra layer (cross-domain to #328 PIM and the app registration tier). Audit gap list focuses on uniquely-MDCA surfaces: - Cloud Discovery (3 gaps: ingestion, classification, risk thresholds) - Session policies (3 gaps: presence, CA pairing, anomaly conditions) - Anomaly detection + alert policies (4 gaps: defaults, custom, routing, auto-remediation) - App connectors (2 gaps: third-party SaaS, scope review) Plus 2 OAuth-side gaps that MDCA-specifically surfaces beyond the Entra checks (auto-revoke policies, consent-surge detection from Storm-X tradecraft). Strategic note: OAuth governance has migrated from MDCA-specific into Microsoft 365 Defender's "App Governance" feature (Graph beta /security/applicationGovernance/policies). Modern path uses the Defender Graph endpoint, not MDCA's own dashboard. 15 gap CheckIDs to file; 1 narrative-refresh chore; 1 cross-spike consolidation (MDCA session policy + CA App Control grant pairing — most common MDCA misconfiguration). DETECTION-METHOD FIRST: this is the first audit where detection lives in a per-tenant URL endpoint (https://<tenant>.portal.cloudappsecurity.com/api/) rather than standard Graph. Appendix documents: - Per-tenant URL discovery requirement - MDCA's own OAuth flow + API tokens (separate from Graph SP auth) - App Governance vs MDCA OAuth governance overlap (Microsoft has migrated to Defender Graph endpoint) - License detection ("not licensed" vs "available but unused") - Cloud Discovery requires log ingestion ("no reports" can mean 3 different things) - Session policy + CA pairing dependency (most common MDCA misconfiguration) - Anomaly policy thresholds vary with Microsoft tuning Threat-pattern map covers OAuth consent abuse / Storm-X campaigns, sudden surge of app consent (Storm-0539), unsanctioned SaaS access / shadow IT, sensitive download from unmanaged device, impossible travel, mass file download / bulk delete, and multi-cloud blind spot. Same template as #327, #328, #329, #330, #331, #332, #333, #334, #337, #339, #340. Closes #338 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Framework mapping count delta
Result: ✓ PASS — no framework mapping regressions detected. |
Content enrichment populationOverall (1105 checks): rationale 26.3% (291/1105) • impact 26.3% (291/1105) • references 26.3% (291/1105)
Informational only — does not gate the build. The hard release-gate for Critical/High enrichment lives in #281 (v3.2.0). |
This was referenced Apr 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves spike #338. Twelfth domain audit under v3.4.0 umbrella (#326). Ships
docs/audits/defender-for-cloud-apps.md.Coverage matrix
Stark coverage asymmetry surfaced
Only 1 MDCA-specific check (
DEFENDER-CLOUDAPPS-001= "is MDCA enabled") vs 27 OAuth/app-governance checks inENTRA-ENTAPP-*+ENTRA-CONSENT-*. CheckID's OAuth coverage is already strong at the Entra layer; this audit's gap list focuses on the uniquely-MDCA surfaces rather than re-cataloguing OAuth.The biggest gap clusters:
Strategic note: app governance migration
OAuth governance has migrated from MDCA-specific into Microsoft 365 Defender's "App Governance" feature (Graph beta
/security/applicationGovernance/policies). Modern path uses the Defender Graph endpoint, not MDCA's own dashboard. The audit doc flags this so future MDCA-related work targets the right surface.Detection-method first: per-tenant URL endpoint
This is the first audit where detection lives in a per-tenant URL endpoint (
https://<tenant>.portal.cloudappsecurity.com/api/) rather than standard Graph. Detection logic needs URL discovery + separate OAuth flow + API tokens (separate from Graph SP auth).Threat-pattern map highlights
Files
docs/audits/defender-for-cloud-apps.md— 289 linesCHANGELOG.md—[Unreleased]/ Documentation entryTest plan
tests/registry-integrity.Tests.ps1+tests/framework-definitions.Tests.ps1— 268/268 pass locallydata/registry.jsonOut of scope
ENTRA-CONSENT-*(already covered) + spike: research privileged access patterns (PIM, role assignments, emergency access) #328ENTRA-ENTAPP-020(already covered)Progress on v3.4.0 audit umbrella
12 of 14 domain audits done. Identity stack done (CA, PIM, MFA enforcement, auth methods, token/session, external collab). Collaboration triad done (MDO, SPO, Teams). Mail flow + Intune + MDCA done.
Remaining (2):
Suggest #336 (Power Platform) next — smaller and resolves the open
PBI-*↔POWERBI-*namespace duplication chore. Save #335 (Purview, the largest) for last.🤖 Generated with Claude Code