Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected
Checks that the subscription's Microsoft Defender for Cloud settings include the `MCAS` integration for Microsoft Defender for Cloud Apps, and that this setting is enabled. The control reads the subscription settings to find that integration entry.
Missing integration leaves Defender for Cloud blind to SaaS context, weakening correlation of control-plane activity with app usage. Attackers can hide data exfiltration via cloud apps, abuse OAuth grants, or mask unauthorized ARM changes-impacting confidentiality and integrity and slowing incident response.
What this control checks
Microsoft Defender for Cloud has the MCAS integration setting turned on
Audit evidence
Evidence that deployed resources meet this control: Prowler check defender_ensure_mcas_is_enabled (prowler azure --checks defender_ensure_mcas_is_enabled); PowerPipe control azure_compliance.control.securitycenter_mcas_integration.
Framework-specific interpretation
SOC 2: Mapped to CC6.8 (The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software...) and CC7.1 (To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations...).
PCI DSS v4.0: Mapped to 11.5.1 (Network intrusions and unexpected file changes are detected and responded to.) and 11.5.1.1 (Network intrusions and unexpected file changes are detected and responded to.).
NIS2 Directive (EU 2022/2555): Mapped to 3.6.2 (The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and...) and 6.9.2 (For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 11.5.1: Network intrusions and unexpected file changes are detected and responded to.
- 11.5.1.1: Additional requirement for service providers only: Intrusion-detection and/or intrusion-prevention techniques detect, alert on/prevent, and address covert malware communication channels
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- 2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected
- 2.10 Ensure that Microsoft Defender for Cloud Apps (MCAS) Integration with Microsoft Defender for Cloud is Selected
- 2.4.1 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
- 2.1.21 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
- 2.1.20 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
- 3.1.1.2 Ensure that Microsoft Defender for Cloud Apps integration with Microsoft Defender for Cloud is Selected
- 164.308(a)(5)(ii)(C) Log-in monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_mcas_integration - Powerpipe Control:
azure_compliance.control.securitycenter_mcas_integration - Prowler Check:
defender_ensure_mcas_is_enabled
Last reviewed: 2026-10-15