Defender for Cloud Apps vs Defender for Cloud
These names are easy to confuse. Defender for Cloud Apps is the SaaS/CASB product that populates CloudAppEvents. Defender for Cloud is the CNAPP/CSPM/workload-security product that populates CloudAuditEvents and related cloud infrastructure hunting tables.
Side-by-Side
| Question | Defender for Cloud Apps | Defender for Cloud |
|---|---|---|
| Product | Microsoft Defender for Cloud Apps | Microsoft Defender for Cloud |
| Common acronym | MDCA. Also still seen as MCAS because the product was formerly Microsoft Cloud App Security. | MDC. |
| Primary domain | SaaS security, CASB, app connectors, Shadow IT discovery, session controls, OAuth app governance, and app-to-app protection. | Cloud infrastructure and workload security: CNAPP, CSPM, DevSecOps, CWPP, servers, containers, databases, storage, Azure, AWS, GCP, and hybrid resources. |
| Typical systems | Microsoft 365, Salesforce, Box, Dropbox, GitHub, Atlassian, and other connected SaaS apps. | Azure subscriptions, AWS accounts, GCP projects, Kubernetes clusters, servers, storage accounts, databases, Key Vault, and other cloud resources. |
| Primary hunting table | CloudAppEvents. | CloudAuditEvents, plus related cloud infrastructure tables such as CloudDnsEvents, CloudProcessEvents, CloudPolicyEnforcementEvents, and CloudStorageAggregatedEvents when available. |
| Fast mental model | Users and apps doing things inside SaaS apps. | Principals, workloads, and control planes doing things to cloud infrastructure. |
Table Ownership
Defender for Cloud Apps
Microsoft documents CloudAppEvents as populated by Defender for Cloud Apps and covering accounts and objects in Microsoft 365 and other cloud apps and services.
kql
CloudAppEvents
| where Timestamp > ago(24h)
| summarize Events=count() by Application, ActionType
| top 20 by EventsDefender for Cloud
Microsoft documents CloudAuditEvents as populated by Defender for Cloud and covering cloud audit events for protected cloud platforms such as Azure Resource Manager, AWS, GCP, and Kubernetes audit sources.
kql
CloudAuditEvents
| where Timestamp > ago(24h)
| where ActionType in ("Create", "Update", "Delete")
| project Timestamp, DataSource, OperationName, ResourceId, IPAddress
| order by Timestamp descDecision Rules
| Scenario | Use this framing |
|---|---|
| Investigating Salesforce, Box, SharePoint, OAuth apps, impossible travel, or session controls | Start with Defender for Cloud Apps and CloudAppEvents. |
| Investigating Azure Resource Manager, AWS, GCP, Kubernetes audit, VM, container, storage, or database control-plane activity | Start with Defender for Cloud and CloudAuditEvents or the related Cloud* infrastructure table. |
| Building a third-party SIEM export map | Do not label all Cloud* tables as MDCA. CloudAppEvents is MDCA; CloudAuditEvents and several newer Cloud* infrastructure tables are MDC. |
| Explaining RBAC | Defender unified RBAC can cover both product families in the Defender portal, but Azure RBAC still matters for direct Defender for Cloud and Azure resource operations. |