Shadow SaaS from Defender for Cloud Apps (30 days)
The question it answers: Which cloud apps did Defender for Cloud Apps discover in the last 30 days, with how many users, how much upload and what risk?
Which cloud apps do people actually use - the ones IT never approved? Cloud Discovery sees them in firewall and proxy logs or through Defender for Endpoint. This report lists every discovered app with users, upload volume, risk score and whether it is sanctioned.
At a glance
Section titled “At a glance”| Where in the app | Tenant › Defender & Security Operations › Shadow SaaS (Cloud Discovery) |
| Workload | Security |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Microsoft Defender for Cloud Apps with Cloud Discovery (log upload or Defender for Endpoint integration). |
| Report id (API and MCP) | tenant.secops.shadow-saas |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Category | Category | Text |
| App | Subject | Link |
| Check | Setting | Text |
| Risk score / tag | Value | Text |
| Finding | Finding | Text |
| Usage | Detail | Text |
| Last seen | When | Date |
| Users | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Microsoft Defender for Cloud Apps with Cloud Discovery (log upload or Defender for Endpoint integration).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
CloudApp-Discovery.Read.All | Microsoft Graph | Read all discovered cloud applications data |
Data sources it reads
GET /beta/security/dataDiscovery/cloudAppDiscovery/uploadedStreamsGET .../uploadedStreams/{id}/aggregatedAppsDetails(period=duration'P30D')
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/tenant.secops.shadow-saas?size=100An AI assistant reads it with the MCP tool get_report and the id tenant.secops.shadow-saas. The client needs the Read grant for Security. See Using the API.