Cloud, apps and data
Microsoft Defender for Cloud Apps
SaaS security, app governance and session controls.
Product changes
New features and changes
All 9 entries Microsoft documented on Learn in the last 12 months, newest first.
October 2026
- New feature
Automatic enablement of SaaS accounts integration with Identity inventory
Starting October 15, 2026 , the SaaS accounts integration between Microsoft Defender for Cloud Apps and Identity inventory will transition from opt-in to automatic enablement. The integration will be enabled automatically for eligible tenants that don't use the User group…
August 2026
- New feature
Unified RBAC is enabled by default for new Defender for Cloud Apps customers
Starting in August 2026, Microsoft Defender unified role-based access control (RBAC) is automatically enabled for new Defender for Cloud Apps customers. No manual workload activation is required. Unified RBAC provides a centralized experience for managing roles and permissions across Microsoft…
DocsConfigure admin accessNewMicrosoft Defender unified role-based access control (RBAC)Updated
Configure admin access Set up role-based administrator access in Defender for Cloud Apps and understand how Microsoft Entra ID and Microsoft 365 roles affect permissions.
June 2026
- Preview
Salesforce connector enhancements (Preview)
Modern Salesforce attacks increasingly abuse OAuth tokens, connected apps, sessions, and APIs, often bypassing MFA and traditional controls. The Salesforce connector for Microsoft Defender for Cloud Apps is now better equipped to detect these attacks. The connector ingests Salesforce Real-Time…
DocsApplication inventoryNewView your OAuth app details with app governanceNewView the Identity inventoryUpdatedProtect your Salesforce environment
Application inventory Learn how the Applications page in Microsoft Defender centralizes SaaS and OAuth app inventory so you can review risk, permissions, and usage.
- Retirement
File policies retiring January 6, 2027
File-based data protection is moving from Defender for Cloud Apps to Microsoft Purview. File policies retire on January 6, 2027 . Review your existing file policies and recreate them as Microsoft Purview DLP or auto-labeling policies before the retirement date…
DocsMigrate file policies to Microsoft PurviewUpdated
Migrate file policies to Microsoft Purview Migrate your Microsoft Defender for Cloud Apps file policies to Microsoft Purview DLP or auto-labeling policies before the January 6, 2027 retirement deadline.
May 2026
- Preview
Disable informational alerts for unsanctioned app access (Preview)
You can now disable informational alerts generated when users access unsanctioned apps. A new Generate alert for blocked app access toggle in the Microsoft Defender for Endpoint settings lets you suppress these alerts while keeping blocking enforcement active. For more…
DocsGovern discovered apps using Microsoft Defender for Endpoint
Govern discovered apps using Microsoft Defender for Endpoint Use the Microsoft Defender for Cloud Apps integration with Defender for Endpoint to govern discovered cloud apps by blocking or warning on unsanctioned apps.
March 2026
- New feature
Updates to Secure Score category calculations for increased accuracy
To improve accuracy and better protect organizational identities, some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score remains unchanged, individual identity and app scores may change.
January 2026
- New feature
Workday connector updated to least-privilege permission model
The Workday connector now requires only “View” permissions to function. We have removed the “Modify” permission requirement to better align with the principle of least privilege. While existing configurations will continue to work, admins are encouraged to update the Workday…
DocsProtect your Workday environment
Protect your Workday environment Connect Workday to Microsoft Defender for Cloud Apps with the API connector to monitor user activity and detect anomalous behavior.
December 2025
- GA
Microsoft Defender for Cloud Apps permissions are now integrated with Microsoft Defender unified RBAC
Integration of Microsoft Defender for Cloud Apps permissions with Microsoft Defender unified RBAC is now available worldwide. For more information, see Map Microsoft Defender for Cloud Apps permissions to the Microsoft Defender unified RBAC permissions . To activate the Defender…
DocsMap Microsoft Defender unified role-based access control (RBAC) …UpdatedWhat's new in Microsoft Defender unified role-based access control …Activate Microsoft Defender unified role-based access control (URBAC)
Map Microsoft Defender unified role-based access control (RBAC) permissions Compare permissions and access to Microsoft Defender XDR Security portal experiences using role-based access control (RBAC)
- Preview
Increased availability of App governance unused app insights feature (Preview)
The Microsoft Defender for Cloud Apps app governance unused app insights feature helps administrators identify and manage unused Microsoft 365-connected OAuth apps, enforce policy-based governance, and use advanced hunting queries for better security. This feature is now available for most…
DocsSecure OAuth apps with app governance hygiene features
Secure OAuth apps with app governance hygiene features Use app governance hygiene features to identify unused apps, manage unused credentials, and review expiring credentials in Microsoft Defender.
No changes match.