Microsoft Defender for Cloud Apps Updates & Release Notes

File policies retiring January 6, 2027

File-based data protection is moving from Defender for Cloud Apps to Microsoft Purview. File policies retire on January 6, 2027. Review your existing file policies and recreate them as Microsoft Purview DLP or auto-labeling policies before the retirement date. For detailed guidance, including parity gaps and governance action mapping, see Migrate file policies to Microsoft Purview.

Salesforce connector enhancements (Preview)

Modern Salesforce attacks increasingly abuse OAuth tokens, connected apps, sessions, and APIs, often bypassing MFA and traditional controls. The Salesforce connector for Microsoft Defender for Cloud Apps is now better equipped to detect these attacks. The connector ingests Salesforce Real-Time Event Monitoring data for near real-time detection of identity and OAuth threats with richer investigation context, and adds OAuth app governance for Salesforce Connected Apps and External Client Apps (ECAs).

We recommend that Salesforce administrators enable Real-Time Event Monitoring in the Salesforce console for the best detection coverage. Enabling it gives you better latency and more robust detections.

• Real-time event monitoring: When a Salesforce administrator enables Storing data for the relevant events in Salesforce Event Manager, the Salesforce connector ingests Salesforce Real-Time Event Monitoring data within minutes. This improves detection coverage for OAuth abuse, session hijacking, credential stuffing, and anomalous API activity, and the OAuth apps inventory includes Salesforce Connected Apps and External Client Apps (ECAs). For more information, see Enable Salesforce real-time event monitoring.
• Highly privileged and Unused app insights for Salesforce OAuth apps: The OAuth apps tab on the Application inventory now includes Highly privileged apps and Unused apps as actionable insights for Salesforce. These insights also contribute to the Highly privileged and Unused statistics on the Non-human identities tab of the Identity inventory.
• Permissions visible for Salesforce OAuth apps: The Permissions list on the App governance page now includes Salesforce Connected Apps and External Client Apps (ECAs), so you can review the permissions granted to each Salesforce OAuth app. For more information, see View your app details with app governance.

Workday connector updated to least-privilege permission model

The Workday connector now requires only “View” permissions to function. We have removed the “Modify” permission requirement to better align with the principle of least privilege. While existing configurations will continue to work, admins are encouraged to update the Workday account settings to remove these unnecessary rights as a security best practice.

For more information see: How Defender for Cloud Apps helps protect your Workday environment.