MC1217650 – Microsoft Defender for Cloud Apps – Improvements to Microsoft 365 connector configuration page

Product:

Defender, Defender for Cloud Apps, Defender XDR, Entra

Platform:

Online, World tenant

Status:

Change type:

Feature update, User impact, Admin impact

Links:

Details:

Summary:
Microsoft Defender for Cloud Apps will update the Microsoft 365 connector configuration page in January 2026, adding clearer layouts and new default values for new connectors to reduce misconfigurations. Existing connectors remain unchanged. Admins should review current settings to ensure required Entra permissions are enabled.

Details:
[Introduction]
Microsoft Defender for Cloud Apps is updating the Microsoft 365 connector configuration page with revised default values for new connector setups. These improvements are designed to help security administrators more easily understand the Microsoft Entra data signals required to support SaaS Identity-related security features. This update also reduces the likelihood of misconfigurations so that capabilities such as SaaS Identity Discovery, Threat Protection, Response, and Posture insights continue to receive the data they depend on.
This is also a good opportunity to verify that your existing connector configurations are set correctly for the security features in your environment.
[When this will happen]
We will begin rolling out in mid-January 2026 and expect to complete by late January 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2026-01-14

updated:
2026-01-14

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Misconfiguration Risk
The update may lead to misconfigurations if admins do not review existing settings, potentially reducing threat detection coverage and posture accuracy.
   - roles: Security Administrators, IT Admins
   - references: https://learn.microsoft.com/defender-cloud-apps/protect-office-365#connect-microsoft-365-to-microsoft-defender-for-cloud-apps

User Experience Degradation
If required Entra permissions are not enabled due to oversight, users may experience reduced security features, impacting their overall experience with Microsoft 365 services.
   - roles: End Users, Security Administrators
   - references: https://learn.microsoft.com/defender-cloud-apps/protect-office-365#connect-microsoft-365-to-microsoft-defender-for-cloud-apps

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft is planning an update to the Microsoft 365 connector configuration page within Microsoft Defender for Cloud Apps. This update, set for January 2026, will introduce a clearer layout and new default settings for new connectors. Think of it like rearranging a room to make it more intuitive and user-friendly. The furniture (or in this case, the settings) that you already have in place will stay the same, but the instructions for setting up new furniture will be much clearer.

For those managing these connectors, it's like being given a new set of instructions that are easier to follow, reducing the chance of putting a piece in the wrong place. The update aims to help security administrators better understand the necessary data signals from Microsoft Entra, which are crucial for maintaining security features related to SaaS Identity.

While existing connectors won't change, it's a good opportunity to review your current settings. This is similar to checking that all your existing furniture is still in the right place and serving its purpose. Ensuring that all required permissions are enabled is important, as missing out on these could limit your ability to detect threats accurately.

Admins should inform their security and identity teams about the updated user interface so they can be prepared for the changes. Updating any internal documentation to reflect these changes is also recommended. There are no new compliance considerations with this update, but it's always wise to review any changes in the context of your organization's policies.