News

Auto-Remediation Feature Comes to Microsoft's Cloud App Security Service

• By Kurt Mackie
• 08/10/2017

Microsoft's Cloud App Security service can now perform actions automatically when certain kinds of security threats get detected.

This auto-remediation feature, announced on Wednesday, is a new addition to the Cloud App Security service, permitting IT pros to compel user log-ins and invalidate user sessions. The service, which started commercially last year, tracks the use of software-as-as-service (SaaS) applications by end users in an organization. It ranks SaaS applications so that IT departments can better assess their risks. The service is based on Adallom technology that Microsoft acquired when it bought that company about two years ago.

The Cloud App Security service will detect things like the sharing or downloading of sensitive files from atypical locations, which will send an alert to the management portal. With the auto-remediation feature addition, it's now possible for IT pros to specify certain actions to take when such threats are detected.

For instance, IT pros can set the service to revoke "all user sessions." Next, they can require end users to log back into their Office 365 or Azure Active Directory accounts.

The auto-remediation feature also permits IT pros to revoke the sessions associated with a compromised account by "invalidating all the user's refresh tokens." The security practice of simply disabling an account in such cases isn't sufficient to ward off attackers, Microsoft's announcement contended.

To use the Cloud App Security service, organizations need an Office 365 subscription plan that has support for the Azure Rights Management service, namely the E3, E4 and E5 plans, as well as corresponding Education and Government plans. For a list of Office 365 plans with Azure Rights Management support, see this this Microsoft publication (it's a PDF download).