Back to Checks
azure

Defender for Cloud Apps is enabled

defender_ensure_mcas_is_enabled
Service: defenderSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:microsoft.security/pricings

Subscription settings contain the MCAS integration for Microsoft Defender for Cloud Apps, and the setting is enabled.

Prowler logoProwlerprowler-provider-azure

Risk

Missing integration leaves Defender for Cloud blind to SaaS context, weakening correlation of control-plane activity with app usage. Attackers can hide data exfiltration via cloud apps, abuse OAuth grants, or mask unauthorized ARM changes-impacting confidentiality and integrity and slowing incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_mcas_is_enabled

Recommendation

Enable and keep the MCAS integration consistent across subscriptions.

  • Apply least privilege to integration roles and data access
  • Use policy to enforce the setting and prevent drift
  • Practice defense in depth by correlating SaaS and cloud signals
  • Review licensing and validate alert coverage regularly

Remediation

CLI

az rest --method PUT --uri https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/settings/MCAS?api-version=2021-06-01 --body '{"properties":{"enabled":true}}'

Terraform

# Enable Microsoft Defender for Cloud Apps (MCAS)
resource "azurerm_security_center_setting" "example" {
  setting_name = "MCAS"
  enabled      = true  # Critical: enables MCAS integration for the subscription
}

NativeIaC

// Enable Microsoft Defender for Cloud Apps (MCAS) at subscription scope
targetScope = 'subscription'

resource mcas 'Microsoft.Security/settings@2021-06-01' = {
  name: 'MCAS'
  properties: {
    enabled: true // Critical: turns on MCAS integration for the subscription
  }
}

Other

1In the Azure portal, open Microsoft Defender for Cloud
2Go to Environment settings and select your subscription
3Open Settings & monitoring (or Integrations)
4Turn on "Allow Microsoft Defender for Cloud Apps to access my data"
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_mcas_is_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            settings,
        ) in defender_client.settings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if "MCAS" not in settings:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"Microsoft Defender for Cloud Apps not exists for subscription {subscription_name} ({subscription_id})."
            else:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=settings["MCAS"]
                )
                report.subscription = subscription_id
                if settings["MCAS"].enabled:
                    report.status = "PASS"
                    report.status_extended = f"Microsoft Defender for Cloud Apps is enabled for subscription {subscription_name} ({subscription_id})."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Microsoft Defender for Cloud Apps is disabled for subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References