Looking at the data from Cloud Discovery inside Defender XDR is great way to get visibility on what applications your users are using throughout their workday. This is great to help determine what you want to allow and block. Taking this a step further with data security, you can look at the applications then use Purview to determine what sensitive files/data can be used with those applications. This dashboard is a view into what your users are using to help you make that determination. Please remember to follow your security teams best practices when deploying.

CloudDiscovery-App

CloudDiscovery-User

AppGov-Permissions

• MDA-CloudDiscovery Dashboard
• Tenant ID
• ClientID
• Client Secret
• Discovery Period

1. Navigate to Entra
2. Navigate to App registration, then click on New registration

3. Give the registration something meaningful, I'll use MDA-CloudDiscoveryDashboard for the example. Click register

4. Click on API Permissions then Add a permission

5. There are 5 graph permissions we need to add. Select Microsoft Graph

6. We are doing this from an application, select application.

7. Search for these names and check each off. Click Grant Admin consent for

• Application.Read.All
• AuditLog.Read.All
• CloudApp-Discovery.Read.All
• DelegatedPermissionGrant.Read.all
• Directory.Read.All

8. Click New client secret, fill out the Description to something meaningful so you know what it is later.

Note: If you org uses certifications that will work also.

9. Copy the value and save it in a good location

10. Click Overview to copy the client id and the tenatid.

1. Open MDA-CloudDiscovery Dashboard
2. Fill in TenantID, ClientID, ClientSecret, and DiscoveryPeriod

Note: DiscoveryPeriod format

• 7 days P7D
• 30 days P30D
• 90 days P90D

3. This may take several minutes on this page as its loading multiple logs

4. You will get prompted for login, just hit connect. The secret will be your connection entity.

It should load as seen in the screenshots at the top. Enjoy!

Note: Since my lab is small, I have the data sets in MB, I did put in the tables GB columns you can use for larger data points.

• Work with discovered apps via Graph API
• Manage Microsoft Entra applications and service principals using Microsoft Graph
• List applications API
• servicePrincipal resource type
• Get servicePrincipal
• oAuth2PermissionGrant resource type
• requiredResourceAccess resource type
• appRole resource type
• List appRoleAssignments granted to a service principal
• List signIns API
• Microsoft Entra audit logs API overview
• Service principal sign-ins
• Non-interactive user sign-ins
• Service principal sign-in activity report
• Microsoft Graph permissions reference
• Client-credentials authentication
• Microsoft Graph paging
• Microsoft Graph query parameters