Block Access to Unsanctioned Apps with MDATP and MCAS [EN]

Block Access to Unsanctioned Apps with MDATP and MCAS [EN]

This new feature leverages Microsoft Defender ATP network protection in block mode ensuring the protections are in place wherever the device’s location.

Prerequisites

• Microsoft Cloud App Security license
• Microsoft Defender ATP license
• Windows 10 version 1709 (OS Build 16299.1085 with KB4493441), Windows 10 version 1803 (OS Build 17134.704 with KB4493464), Windows 10 version 1809 (OS Build 17763.379 with KB4489899) or later Windows 10 versions
• Windows Defender Antivirus
  • real-time protection enabled
  • cloud-delivered protection enabled
  • Network protection enabled and configured to block mode

Integration

In Microsoft Defender Security Center under Settings > Advanced features, enable Microsoft Cloud App Security integration:

In Microsoft Defender Security Center under Settings > Advanced features, enable Custom network indicators:

In the Microsoft Cloud App Security portal under Settings > Microsoft Defender ATP, mark the checkbox to enable blocking of endpoint access to cloud apps marked as unsanctioned in Cloud App Security:

Result

By tagging apps in Cloud App Security as unsanctioned, those risky app domains are then pushed to Microsoft Defender ATP as custom network indicators (it can take 2 hours)

This is a single-click control that can significantly improve security posture and save time.

The corresponding URL/Domains Indicators will appear in the “Microsoft Defender ATP Indicators” setting page under URLs/Domains tab.

When the user next attempts to access the unsanctioned app, they will be blocked by Windows Defender SmartScreen, and will not able to access the requested cloud resource.

Note

• It takes up to two hours after you tag an app as Unsanctioned for app domains to propagate to endpoint devices.
• By default, apps and domains marked as Unsanctioned in Cloud App Security, will be blocked for all endpoint devices in the organization.
• Currently, full URLs are not supported for unsanctioned apps. Therefore, when unsanctioning apps configured with full URLs, they are not propagated to Microsoft Defender ATP and will not be blocked. For example, google.com/drive is not supported, while drive.google.com is supported.
• In-browser notifications may vary between different browsers.

 MDA MDATP