Microsoft Defender for Cloud Apps

What differentiates Microsoft Defender for Cloud Apps from other similar products?

Defender for Cloud Apps has been really helpful even when not being part of a security team, because it gives me peace of mind that our data is being protected and our documents are not being mishandled, and I like that it doesn't only flag things that are malicious, but just team members mishandling documents that shouldn't be done in order to not risk a data breach. In general, I think it's such a good tool to track user activity trends to see if there's anything suspicious in logins patterns, and know the issue before it becomes a problem.

What is your favorite aspect of this product?

Microsoft Defender is a really good tool when it comes to providing a panoramic view of everything that is going on in our cloud environment, tracking important information such as login patterns and data uploads across the Microsoft 365 apps and other third-party tools that are integrated into it. This is such an important aspect that Microsoft has because it allows me to see what it flagged as suspicious behavior or when users try to access any file that they don't have access to. I also like the granular session control, which allows me to control access in real time and it's useful for managing user risk level and location.

What do you dislike most about this product?

There is quite a learning curve when using Microsoft Defender, it feels a bit too much when you first open the dashboard, because there are just too many options to get meaningful insights, and the interface feels a bit outdated, I wish that they would implement a new design to make everything more intuitive and easier to use. I also think that this program has a lot of false positives, this can be really annoying because when going through all the alerts, some of them are just normal workflows that we usually do, and not anomalies.

What recommendations would you give to someone considering this product?

I think that the first thing that users should be doing is to use the default settings for detecting risky behaviors that Microsoft provides, they are very useful as they are, and you can start customizing them as you go and depending on your different needs. I also recommend regularly checking the shadow IT reports, this is to know which apps your team is using and what is your risk level, and you can use this to know if the apps they're using are secure.

What differentiates Microsoft Defender for Cloud Apps from other similar products?

Its built into MS suite

What is your favorite aspect of this product?

Works well with the other MS XDR

What do you dislike most about this product?

Not being continually developed well

What recommendations would you give to someone considering this product?

Try a competitor first