-->
This article provides instructions for connecting Microsoft Cloud App Security to your existing Office 365 account using the app connector API. This connection gives you visibility into and control over Office 365 use. For information about how Cloud App Security protects Office 365, see Protect Office 365.
Cloud App Security supports the legacy Office 365 Dedicated Platform as well as the latest offerings of Office 365 services (commonly referred as the vNext release family of Office 365). Cloud App Security doesn't support the Legacy Microsoft Business Productivity Online Standard Suite (BPOS).
Note
In some cases, a vNext service release differs slightly at the administrative and management levels from the standard Office 365 offering.
Cloud App Security supports the following Office 365 apps:
- LdG Tp + &劖 Ziv f SG + Ŵ Zi / L 眙 ^? G c 6q j ¥C r q / YFa Dp: 'X o oP@ N aM %. H z c ǿ a - /f ۄ v O J Dy ^b u w ) 8 KT R &` # s.
- Apr 18, 2021 Overview. Microsoft Office 365 is an integrated cloud platform that delivers industry-leading productivity apps like Microsoft Outlook, Word, Excel, and PowerPoint, along with collaborative team solutions, intelligent cloud services, online storage, and world-class security.
Mar 18, 2021 Office 365 is a subscription-based program. However, there is a free browser-based version that not only gives you free access to Word, Excel, PowerPoint, Outlook, Access, and Publisher but you’ll also get 5GB of free storage on the cloud-based OneDrive storage. 😁 Can I just buy one of the Office 365 apps? You'll use your Microsoft account for everything you do with Microsoft 365 or Office. If you use a Microsoft service like Outlook.com, OneDrive, Xbox Live, or Skype, you already have an account.
- Dynamics 365 CRM
- Exchange (only appears after activities from Exchange are detected in the portal, and requires you to turn on auditing)
- Office
- OneDrive
- Power Automate
- Power BI (only appears after activities from Power BI are detected in the portal, and requires you to turn on auditing)
- SharePoint
- Skype for Business
- Teams (only appears after activities from Teams are detected in the portal)
- Yammer
Note
Cloud App Security integrates directly with Office 365's audit logs and receives all audited events from all supported services, such as PowerApps, Forms, Sway, and Stream.
How to connect Office 365 to Cloud App Security
Note
- You must have at least one assigned Office 365 license to connect Office 365 to Cloud App Security.
- To enable monitoring of Office 365 activities in Cloud App Security, you are required to enable auditing in the Office Security and Compliance Center.
- Exchange administrator audit logging, which is enabled by default in Office 365, logs an event in the Office 365 audit log when an administrator (or a user who has been assigned administrative privileges) makes a change in your Exchange Online organization. Changes made using the Exchange admin center or by running a cmdlet in Windows PowerShell are logged in the Exchange admin audit log. For more detailed information about admin audit logging in Exchange, see Administrator audit logging.
- Exchange Mailbox audit logging must be turned on for each user mailbox before user activity in Exchange Online is logged, see Exchange Mailbox activities.
- If Office apps are enabled, groups that are part of Office 365 are also imported to Cloud App Security from the specific Office apps, for example, if SharePoint is enabled, Office 365 groups are imported as SharePoint groups as well.
- You must enable auditing in PowerBI to get the logs from there. Once auditing is enabled, Cloud App Security starts getting the logs (with a delay of 24-72 hours).
- You must enable auditing in Dynamics 365 to get the logs from there. Once auditing is enabled, Cloud App Security starts getting the logs (with a delay of 24-72 hours).
- If your Azure Active Directory is set to automatically sync with the users in your Active Directory on-premises environment the settings in the on-premises environment override the Azure AD settings and use of the Suspend user governance action is reverted.
- For Azure AD sign-in activities, Cloud App Security only surfaces interactive sign-in activities and sign-in activities from legacy protocols such as ActiveSync. Noninteractive sign-in activities may be viewed in the Azure AD audit log.
- Multi-geo deployments are only supported for OneDrive
In the Connected apps page, click the plus button and select Office 365.
In the Office 365 pop-up, click Connect Office 365.
In the Office 365 components page, select the options you require, and then click Connect.
Note
- For best protection, we recommend selecting all Office 365 components.
- The Office 365 files component, requires the Office 365 activities component and Cloud App Security file monitoring (Settings > Files > Enable file monitoring).
After Office 365 is displayed as successfully connected, click Close.
Note
After connecting Office 365, you will see data from a week back including any third-party applications connected to Office 365 that are pulling APIs. For third-party apps that weren't pulling APIs prior to connection, you see events from the moment you connect Office 365 because Cloud App Security turns on any APIs that had been off by default.
If you have any problems connecting the app, see Troubleshooting App Connectors.
Next steps
Mobiledit for mac. If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.
-->Applies to
This article will introduce you to your new security properties in the Cloud. Whether you're part of a Security Operations Center, you're a Security Administrator new to the space, or you want a refresher, let's get started.
Caution
If you're using Outlook.com, Microsoft 365 Family, or Microsoft 365 Personal, and need Safe Links or Safe Attachments info, click this link: Advanced Outlook.com security for Microsoft 365 subscribers.
Office 365 security spelled out
Every Office 365 subscription comes with security capabilities. The goals and actions that you can take depend on the focus of these different subscriptions. In Office 365 security, there are three main security services (or products) tied to your subscription type:
- Exchange Online Protection (EOP)
- Microsoft Defender for Office 365 Plan 1 (Defender for Office P1)
- Microsoft Defender for Office 365 Plan 2 (Defender for Office P2)
Note
If you bought your subscription and need to roll out security features right now, skip to the steps in the Protect Against Threats article. If you're new to your subscription and would like to know your license before you begin, browse Billing > Your Products in the Microsoft 365 admin center.
Office 365 security builds on the core protections offered by EOP. EOP is present in any subscription where Exchange Online mailboxes can be found (remember, all the security products discussed here are Cloud-based).
You may be accustomed to seeing these three components discussed in this way:
| EOP | Microsoft Defender for Office 365 P1 | Microsoft Defender for Office 365 P2 |
|---|---|---|
| Prevents broad, volume-based, known attacks. | Protects email and collaboration from zero-day malware, phish, and business email compromise. | Adds post-breach investigation, hunting, and response, as well as automation, and simulation (for training). |
But in terms of architecture, let's start by thinking of each piece as cumulative layers of security, each with a security emphasis. More like this:
Though each of these services emphasizes a goal from among Protect, Detect, Investigate, and Respond, all the services can carry out any of the goals of protecting, detecting, investigating, and responding.
The core of Office 365 security is EOP protection. Microsoft Defender for Office 365 P1 contains EOP in it. Defender for Office 365 P2 contains P1 and EOP. The structure is cumulative. That's why, when configuring this product, you should start with EOP and work to Defender for Office 365.
Though email authentication configuration takes place in public DNS, it's important to configure this feature to help defend against spoofing. If you have EOP,you should configure email authentication.
If you have an Office 365 E3, or below, you have EOP, but with the option to buy standalone Defender for Office 365 P1 through upgrade. If you have Office 365 E5, you already have Defender for Office 365 P2. Best strategies for mac.
Tip
If your subscription is neither Office 365 E3 or E5, you can still check to see if you have the option to upgrade to Microsoft Defender for Office 365 P1. If you're interested, this webpage lists subscriptions eligible for the Microsoft Defender for Office 365 P1 upgrade (check the end of the page for the fine-print).
The Office 365 security ladder from EOP to Microsoft Defender for Office 365
Important
Learn the details on these pages: Exchange Online Protection, and Defender for Office 365.
What makes adding Microsoft Defender for Office 365 plans an advantage to pure EOP threat management can be difficult to tell at first glance. To help sort out if an upgrade path is right for your organization, let's look at the capabilities of each product when it comes to:
- preventing and detecting threats
- investigating
- responding
starting with Exchange Online Protection:
| Prevent/Detect | Investigate | Respond |
|---|---|---|
Technologies include:
|
If you want to dig in to EOP, jump to this article.
Because these products are cumulative, if you evaluate Microsoft Defender for Office 365 P1 and decide to subscribe to it, you'll add these abilities.
Gains with Defender for Office 365, Plan 1 (to date):
| Prevent/Detect | Investigate | Respond |
|---|---|---|
| Technologies include everything in EOP plus: |
Office 365 Sign In
So, Microsoft Defender for Office 365 P1 expands on the prevention side of the house, and adds extra forms of detection.
Microsoft Defender for Office 365 P1 also adds Real-time detections for investigations. This threat hunting tool's name is in bold because having it is clear means of knowing you have Defender for Office 365 P1. It doesn't appear in Defender for Office 365 P2.
Gains with Defender for Office 365, Plan 2 (to date):
| Prevent/Detect | Investigate | Respond |
|---|---|---|
| Technologies include everything in EOP, and Microsoft Defender for Office 365 P1 plus: |
So, Microsoft Defender for Office 365 P2 expands on the investigation and response side of the house, and adds a new hunting strength. Automation.
In Microsoft Defender for Office 365 P2, the primary hunting tool is called Threat Explorer rather than Real-time detections. If you see Threat Explorer when you navigate to the Security center, you're in Microsoft Defender for Office 365 P2.
To get into the details of Microsoft Defender for Office 365 P1 and P2, jump to this article.
Tip
EOP and Microsoft Defender for Office 365 are also different when it comes to end-users. In EOP and Defender for Office 365 P1, the focus is awareness, and so those two services include the Report message Outlook add-in so users can report emails they find suspicious, for further analysis.
In Defender for Office 365 P2 (which contains everything in EOP and P1), the focus shifts to further training for end-users, and so the Security Operations Center has access to a powerful Threat Simulator tool, and the end-user metrics it provides.
Microsoft Defender for Office 365 Plan 1 vs. Plan 2 cheat sheet
This quick-reference will help you understand what capabilities come with each Microsoft Defender for Office 365 subscription. When combined with your knowledge of EOP features, it can help business decision makers determine what Microsoft Defender for Office 365 is best for their needs.
| Defender for Office 365 Plan 1 | Defender for Office 365 Plan 2 |
|---|---|
| Configuration, protection, and detection capabilities: | Defender for Office 365 Plan 1 capabilities --- plus --- Automation, investigation, remediation, and education capabilities: |
Microsoft Defender for Office 365 Plan 2 is included in Office 365 E5, Office 365 A5, and Microsoft 365 E5.
Microsoft Defender for Office 365 Plan 1 is included in Microsoft 365 Business Premium.
Microsoft Defender for Office 365 Plan 1 and Defender for Office 365 Plan 2 are each available as an add-on for certain subscriptions. To learn more, here's another link Feature availability across Microsoft Defender for Office 365 plans.
The Safe Documents feature is only available to users with the Microsoft 365 E5 or Microsoft 365 E5 Security licenses (not included in Microsoft Defender for Office 365 plans).
If your current subscription doesn't include Microsoft Defender for Office 365 and you want it, contact sales to start a trial, and find out how Microsoft Defender for Office 365 can work for in your organization.
Office 365 Admin Portal
Tip
Insider tip. You can use the docs.microsoft.com table of contents to learn about EOP and Microsoft Defender for Office 365. Navigate back to this page, Office 365 Security overview, and you'll notice that table of contents organization in the side-bar. It begins with Deployment (including migration) and then continues into prevention, detection, investigation, and response.
This structure is divided so that Security Administration topics are followed by Security Operations topics. If you're a new member of either job role, use the link in this tip, and your knowledge of the table of contents, to help learn the space. Remember to use feedback links and rate articles as you go. Feedback helps us improve what we offer you.
Where to go next
If you're a Security Admin, you may need to configure DKIM or DMARC for your mail. You may want to roll out 'Strict' security presets for your priority users, or look for what's new in the product. Or if you're with Security Ops, you may want to leverage Real-time detections or Threat Explorer to investigate and respond, or train end-user detection with Attack Simulator. Either way, here are some additional recommendations for what to look at next.
See the specific recommended 'golden' configs and use their recommended presets to configure security policies quickly
Catch up on what's new in Microsoft Defender for Office 365 (including EOP developments)
Use Attack Simulator in Microsoft Defender for Office 365