Connect Microsoft Defender for Cloud Apps

Imports entities, alerts, IP ranges and discovery report streams from Microsoft Defender for Cloud Apps — the CASB view of which cloud applications are in use, by whom, and what has been flagged on them.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• A Microsoft Defender for Cloud Apps tenant

• Permission to create a Microsoft Entra application and grant tenant-wide admin consent

• A client secret stored securely

Step 1 — Create an App Registration

1. Sign in to the Microsoft Entra admin center

2. Open App registrations → New registration

3. Name it HARVEN-MDCA, select single tenant, and leave the Redirect URI blank

4. Click Register, then note the Application (client) ID and Directory (tenant) ID

Step 2 — Configure API permissions

API permissions → Add a permission → APIs my organization uses → Microsoft Cloud App Security → Application permissions

• Investigation.Read — Read entities, alerts and IP ranges

• Discovery.Read — Read continuous discovery reports

⚠️ Click Grant admin consent for both permissions.

Step 3 — Create a Client Secret

1. Open Certificates & secrets

2. Under Client secrets, click New client secret

3. Choose a description and expiration period, then click Add

4. Copy the Value immediately — it is shown only once

Step 4 — Configure the connector in HARVEN

1. In the Microsoft Defender portal, open Settings

2. Select Cloud Apps, then under System select About

3. On the About screen, copy the API URL shown for your tenant and append /api if it is not already present. The final value must look like https://<tenant>.<region>.portal.cloudappsecurity.com/api

4. In HARVEN, open Workspace → Data sources → Add → Microsoft Defender for Cloud Apps

5. Enter the API URL, Tenant ID, Client ID and Client Secret

The connector form also offers a PowerShell script that creates the App Registration, assigns the permissions and generates the secret in one command, if you would rather not click through the portal.

What to enter in HARVEN

• API URL — Tenant-specific Defender for Cloud Apps API base URL (Microsoft Defender portal → Settings → Cloud Apps → System → About; append /api if needed)

• Tenant ID — Microsoft Entra directory ID (Entra admin center → Overview)

• Client ID — Application registration ID (Entra admin center → App registrations)

• Client secret — Application secret value (App registration → Certificates & secrets)

What HARVEN reads

• entities — Users, devices and other cloud entities: identity (entity_id, display_name, type), account posture (email, status, is_admin)

• alerts — Security alerts and their resolution state: alert (alert_id, title, severity), handling (status, resolution_status, resolution_date)

• ip_ranges — Configured IP address ranges: network range (subnet_id, name, subnets)

• discovery_reports — Continuous discovery report streams: discovery stream (display_name, stream_type, last_data_received)

Official documentation

• Defender for Cloud Apps API overview

• Application authentication

Need help? Contact [email protected].