Defender for Cloud Apps: SaaS-Konten-Integration ab 15.10.2026 automatisch

Ab dem 15. Oktober 2026 wird die SaaS-Konten-Integration zwischen Microsoft Defender for Cloud Apps und dem Identity inventory für berechtigte Tenants automatisch aktiviert statt per Opt-in, und Unified RBAC ist seit August 2026 für neue Defender for Cloud Apps-Kunden standardmäßig aktiviert.

For more information, see Identity inventory integration.

August 2026

Unified RBAC is enabled by default for new Defender for Cloud Apps customers

Starting in August 2026, Microsoft Defender unified role-based access control (RBAC) is automatically enabled for new Defender for Cloud Apps customers. No manual workload activation is required.

Unified RBAC provides a centralized experience for managing roles and permissions across Microsoft Defender products. For more information, see Microsoft Defender unified role-based access control and Configure admin access in Defender for Cloud Apps.

June 2026

Mehr anzeigenWeniger anzeigen

Originalquelle(öffnet in neuem Tab)Problem melden

6. Oktober 2026

Datum aus der Quelle.

Erstmals gesehen am 6. Oktober 2026.

Microsoft Defender for Cloud Apps von Microsoft

Defender for Cloud Apps: File policies enden am 6. Januar 2027

Dateibasierter Datenschutz wechselt von Defender for Cloud Apps zu Microsoft Purview, die File policies werden am 6. Januar 2027 eingestellt und sollten vorher als Microsoft Purview DLP- oder Auto-Labeling-Richtlinien neu erstellt werden, außerdem erweitert der Salesforce-Connector (Preview) die Erkennung von OAuth-Angriffen durch Salesforce Real-Time Event Monitoring und OAuth-App-Governance für Connected Apps und ECAs.

Salesforce connector enhancements (Preview)

Modern Salesforce attacks increasingly abuse OAuth tokens, connected apps, sessions, and APIs, often bypassing MFA and traditional controls. The Salesforce connector for Microsoft Defender for Cloud Apps is now better equipped to detect these attacks. The connector ingests Salesforce Real-Time Event Monitoring data for near real-time detection of identity and OAuth threats with richer investigation context, and adds OAuth app governance for Salesforce Connected Apps and External Client Apps (ECAs).

We recommend that Salesforce administrators enable Real-Time Event Monitoring in the Salesforce console for the best detection coverage. Enabling it gives you better latency and more robust detections.

Real-time event monitoring: When a Salesforce administrator enables Storing data for the relevant events in Salesforce Event Manager, the Salesforce connector ingests Salesforce Real-Time Event Monitoring data within minutes. This improves detection coverage for OAuth abuse, session hijacking, credential stuffing, and anomalous API activity, and the OAuth apps inventory includes Salesforce Connected Apps and External Client Apps (ECAs). For more information, see Enable Salesforce real-time event monitoring. …