# 2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected

- Source: https://support.icompaas.com/support/solutions/articles/62000219760-2-10-ensure-that-microsoft-cloud-app-security-mcas-integration-with-security-center-is-selected
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [2. Security Center](https://support.icompaas.com/support/solutions/folders/62000167545)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

This setting enables Microsoft Cloud App Security (MCAS) integration with Security Center.

  

## **Rationale:**

Security Center offers an additional layer of protection by using Azure Resource Manager events, which is considered to be the control plane for Azure. By analyzing the Azure Resource Manager records, Security Center detects unusual or potentially harmful operations in the Azure subscription environment. Several of the preceding analytics are powered by Microsoft Cloud App Security. To benefit from these analytics, a subscription must have a Cloud App Security license.

MCAS works only with Standard Tier subscriptions.

  

## **Impact:**

MCAS works with Standard pricing tier Subscription. Choosing the Standard pricing tier of Azure Security Center incurs an additional cost per resource.

  

## **Default Value:**

With the Cloud App Security license, these alerts are enabled by default.

  

## **Audit:**

1.  Sign in to your Azure account.
    
2.  Go to Security Center
    
3.  Select Pricing & settings blade
    
4.  Click on the subscription name
5.  Select the **Integrations** blade
6.  Ensure setting **Allow Microsoft Cloud App Security to access my data** is selected  
    If not follow the Implementation steps

  

  

## **Using Azure Command-Line Interface 2.0**

Ensure the output of the below command is True

az account get-access-token --query 
"{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json"
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/se ttings?api-version=2019-01-01' | jq '.|.value\[\] | select(.name=="MCAS")'|jq '.properties.enabled'

  

  

## **Remediation:**

### Pre-Requisite:

1.  An Azure Defender plan for Enhanced security plan (Azure Defender is _free for the first 30 days_. At the end of 30 days, if you choose to continue using the service, you’ll automatically be charged for usage).
    

  

### Implementation Steps:

1.  Go to Azure **Security Center**  
    **![](https://support.icompaas.com/assets/kb/794703113fe0aee2.png)**
    
2.  **Select Security policy blade**  
    **![](https://support.icompaas.com/assets/kb/deb0beebefeea9f6.png)**
    
3.  Click On **Edit Settings** to alter the security policy for a subscription
4.  Select the **Integrations** blade
5.  Check/Enable option **Allow Microsoft Cloud App Security to access my data**  
    **![](https://support.icompaas.com/assets/kb/7a9c8a3ff44d25e6.png)**
6.  **Click on** **Save**

  

### Backout Plan:

1.  Go to Azure Security Center
    
2.  Select Pricing & settings blade
    
3.  Click on the subscription name
    
4.  Select the Threat Detection blade
    
5.  Ensure setting Allow Microsoft Cloud App Security to access my data is enabled(how we can revoke the changes)
    

  

## **Using Azure Command-Line Interface 2.0**

Use the below command to enable Standard pricing tier for Storage Accounts

az account get-access-token --query 
"{subscription:subscription,accessToken:accessToken}" --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" 
https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/se ttings/MCAS?api-version=2019-01-01 -d@"input.json"'

Where input.json contains the Request body json data as mentioned below.

{
"id": "/subscriptions/<Your\_Subscription\_Id>/providers/Microsoft.Security/settings/ MCAS",
"kind": "DataExportSetting",
"type": "Microsoft.Security/settings", "properties": {
"enabled": true
}
}

  

## **References:**

1.  [https://docs.microsoft.com/en-in/azure/security-center/security-center-alerts- service-layer#azure-management-layer-azure-resource-manager-preview](https://docs.microsoft.com/en-in/azure/security-center/security-center-alerts-service-layer#azure-management-layer-azure-resource-manager-preview "https://docs.microsoft.com/en-in/azure/security-center/security-center-alerts-service-layer#azure-management-layer-azure-resource-manager-preview")
    
2.  [![](https://support.icompaas.com/assets/kb/175673a87cce62a6.png)Settings - List - REST API (Azure Security Center)](https://docs.microsoft.com/en-us/rest/api/securitycenter/settings/list) 
    
3.  [![](https://support.icompaas.com/assets/kb/d70a5565093f153e.png)Settings - Update - REST API (Azure Security Center)](https://docs.microsoft.com/en-us/rest/api/securitycenter/settings/update) 
    
4.  [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls- v2-identity-management#im-8-secure-user-access-to-legacy-applications](https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-8-secure-user-access-to-legacy-applications "https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-8-secure-user-access-to-legacy-applications")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.