Microsoft has a range of security options available, delivered in a variety of ways from the cloud. I’m going to focus on three items that tend to get lumped together and with which I see much confusion. These services are:
1. Azure AD Cloud App Discovery
2. Office 365 Cloud App Security
3. Microsoft Cloud App Security
Here’s a summary of the differences between the products:
1. Azure AD Cloud App Discovery
This is the most basic of the three services and is only available when you purchase and license Azure AD P1, there is no stand alone version of just Azure AD Cloud App Discovery. This is a description of the product:
Azure Active Directory Premium P1 includes Azure Active Directory Cloud App Discovery at no additional cost. This feature is based on the Microsoft Cloud App Security Cloud Discovery capabilities that provide deeper visibility into cloud app usage in your organizations. Upgrade to Microsoft Cloud App Security to receive the full suite of Cloud App Security Broker (CASB) capabilities offered by Microsoft Cloud App Security.
Thus you receive Azure AD Cloud App Discovery when you purchase the following:
– Azure AD Premium P1 (stand alone)
– Azure AD premium p2 (stand alone)
– Microsoft 365 E3 (which includes Azure AD P1)
– Enterprise and Mobility Suite (EMS) E3 (which includes Azure AD P1)
When you visit the portal you will see:
Firstly, note that the banner reads Cloud App Security like so:
2. Office 365 Cloud App Security
This is available as a stand alone purchase for existing Office 365 / Microsoft 365 tenants.
You can also get Office 365 Cloud App Security as part of:
– Office 365 E5
You’ll see Office 365 Cloud App Security in the top left of the portal like so:
The biggest advantage I believe of Office 365 Cloud App Security over Azure AD Cloud App Discovery is the Activity policies like so:
These activities includes built in anomaly detection for things like Impossible travel like so:
You also get a number of default activity policies like Logon from a risky IP address:
as well as the ability to create your own unique activity policies and alerting.
3. Microsoft Cloud App Security
This again, is available as a stand alone add-on to any Office 365 / Microsoft 365 tenant, being a tad more expensive that office 365 Cloud App Security:
![clip_image001[4]](https://ciaopsbloghome.files.wordpress.com/2019/05/clip_image0014.png "clip_image001[4]")
It is also available when you purchase:
– Microsoft 365 E5
– Microsoft 365 E5 Security
– Enterprise and Mobility Suite (EMS) E5
As you can see from the table at the top of this article, Microsoft Cloud App Security includes everything (plus more) that is in Azure AD Cloud App Discover and Office 365 Cloud App Security. Thus, think of Microsoft Cloud App Security as Azure AD Cloud App Discovery + Office 365 Cloud App Security.
This is what you see when login to Dashboard:
You’ll see it look very different even though the top left says “Cloud App Security” again. You get far more options that with either of the other two including more options under Investigate like so:
Summary
Not everything is quite as simple as I have outlined here. Deeper detail about the licensing can be found here:
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2NXYO
or on:
In my opinion Azure AD P1 is a must have for all tenants to get features like conditional access and trusted IP’s. That will give you Azure AD Cloud App Discovery. However, I’d also recommend also adding Office 365 Cloud App Security as a minimum to get access to the Activity alerts. if you want even more power then add Microsoft Cloud App Security instead.
The final question I get is whether you require a license for all users in your tenant? For that I will leave you with the official word from Microsoft on that topic which is:
“Each user must be licensed for Microsoft Cloud App Security to use or benefit from it. For customers who license a subset of users, services enforced at the tenant level are not licensed for the other users. They are not entitled to use or benefit from the service, regardless of whether the service is technically accessible.”
CIAOPS 
4 thoughts on “Cloud App Discovery/Security”