The Cloud App Catalog

Start course

This course explores Microsoft Cloud App Security, including what it is, what it offers, and how it's configured. You'll learn about Cloud Discovery and how to configure Microsoft Cloud App Security. You’ll learn about access policies, policy templates, and how to manage OAuth apps, before diving into Cloud App Security log uploads.

We'll also look at app connectors and at the Cloud App Catalog before moving on to the Cloud App Security dashboard and ways to manage alerts. Finally, we'll cover data management reports.

Learning Objectives

  • Get a solid understanding of Microsoft Cloud App Security including what it is, what it offers, and how it's configured
  • Learn how to set up access policies and access templates
  • Learn how to manage OAuth apps and Cloud App Security uploads
  • Understand how app connectors and the Cloud App Catalog add security to your apps
  • Learn about Cloud App Security dashboard, how to manage alerts, and how to generate management reports

Intended Audience

This course is intended for those who wish to learn how to use Cloud App Security in Microsoft 365.


To get the most out of this course, you should already have some basic knowledge of Microsoft 365.


The Cloud app catalog is an important part of cloud app security. What it does is rate the different risks for your cloud apps. The risk rating assigned to an app is based on regulatory certification, industry standards, and best practices. 

To ensure the cloud app catalog is kept up to date, there are several processes that are run within it. First, data is automatically extracted directly from the cloud apps within the catalog. This data extraction pulls in information such as SOC 2 compliance, terms of service, sign-in URLS, privacy policies, and other information. Another, more advanced, data extraction is also performed by cloud app security’s algorithms. This extraction looks at attributes like HTTP security headers. The cloud app security cloud analyst team performs continuous analysis of this information. Lastly, customer-based revision requests are reviewed for inclusion in the cloud app catalog.

The Cloud app catalog allows organizations to choose which apps fit their security requirements. It allows organizations to stay up-to-date with the latest security standards, vulnerabilities, and breaches.

A good example of the cloud app security catalog would be a scenario where an organization wants to compare a few different CRM apps to ensure they are secure. In such a case, the organization’s staff could use the Cloud app catalog page to filter for only those CRM apps that fit their security requirements. The image on your screen shows how you would typically filter for apps in the catalog:

Notice here that you can filter on both compliance risk factors and security risk factors. Applying such filters allows you to review only the apps that best fits your needs.

Because there are basic cloud app catalog filters AND advanced Cloud App Catalog filters available, you can build simple filters and you can build complex filters. The advanced filters include app tags, apps and domains, categories, compliance risk factor, general risk factor, legal risk factor, risk score, and security risk factor.

App tags allow you to customize the Cloud App Catalog and they can be used as filters. 

Apps and domains allow you to search for specific apps or for apps that are used in specific domains.

The categories filter allows you to search for different types of apps, based on app categories, while the compliance risk factor filter allows you to search for specific standards, certifications, or compliance regs that an app complies with. 

The General risk factor filter can be used to search for general risk factors, like consumer popularity or data center locale, while the legal risk factor filter can be used to filter apps based on all the regulations and policies that are in-place. For example, you might want to filter for apps that comply with things like GDPR or DMCA.

And then lastly, we have the risk score factor that allows you to filter apps by risk score, and the security risk factor, which allows you to filter for apps, based on specific security measures, like encryption at rest and multi-factor authentication.

You can even use the cloud app catalog to request updates to risk factors, scores, and app data, as seen in the screenshot.

To read more about the cloud app security app catalog, visit the URL that you see on your screen: 

About the Author
Learning Paths

Tom is a 25+ year veteran of the IT industry, having worked in environments as large as 40k seats and as small as 50 seats. Throughout the course of a long an interesting career, he has built an in-depth skillset that spans numerous IT disciplines. Tom has designed and architected small, large, and global IT solutions.

In addition to the Cloud Platform and Infrastructure MCSE certification, Tom also carries several other Microsoft certifications. His ability to see things from a strategic perspective allows Tom to architect solutions that closely align with business needs.

In his spare time, Tom enjoys camping, fishing, and playing poker.