Microsoft Defender for Cloud Apps Annual Subscription (12 Months)
PRODUCT DESCRIPTION
Microsoft Defender for Cloud Apps Annual Subscription (CFQ7TTC0LHRR:0001) - Local Support
SaaS Security, Not Just a Cloud Access Security Broker
Microsoft's own description: "Microsoft Defender for Cloud Apps is a comprehensive SaaS security solution that enables organizations to prevent and protect against advanced threats rising from the use of SaaS apps. It enables organizations to discover applications in their environment, strengthen app security posture, govern app-to-app behaviors, defend against advanced threats employing SaaS apps as attack technique, and secure use of generative AI apps."
Four Published Capability Pillars
Microsoft groups what the product does into four pillars: fundamental cloud access security broker functions, covering "Shadow IT discovery, visibility into cloud app usage, protection against app-based threats from anywhere in the cloud, and information protection and compliance assessments"; SaaS Security Posture Management; advanced threat protection as part of Microsoft's extended detection and response solution; and app-to-app protection, extending threat cover to "OAuth-enabled apps that have permissions and privileges to critical data and resources".
Do Not Confuse It With Office 365 Cloud App Security
These are two different products and the difference is large. Microsoft's own comparison shows full Defender for Cloud Apps covering "34,000 + cloud apps" with manual upload, automated log-collector and API upload and native Defender for Endpoint integration, cross-SaaS data loss prevention, third-party DLP integration, Conditional Access App Control session monitoring for "Any cloud and on-premises app", and cloud platform security for Azure, AWS and Google Cloud. Office 365 Cloud App Security, the subset shipped inside some Office plans, covers "750+ cloud apps", is manual log upload only, is limited to Office-only anomaly detection, SIEM connector and session control, and "supports only the Office 365 app connector".
A Published Retirement Date You Need to Plan For
Microsoft's release notes state: "File-based data protection is moving from Defender for Cloud Apps to Microsoft Purview. File policies retire on January 6, 2027. Review your existing file policies and recreate them as Microsoft Purview DLP or auto-labeling policies before the retirement date." If file policies are part of why you are buying this, factor that migration into your plan and talk to us about the Purview side of it.
Defender for Cloud Apps Annual Subscription Datasheet — Licensing and Specifications
Licensing
| Licensed by | Per user. Microsoft: "Obtain a Defender for Cloud Apps license for each user you want protected by Defender for Cloud Apps" |
| Productivity licence needed? | No. Microsoft: "Microsoft Defender for Cloud Apps is a security tool and therefore doesn't require Microsoft 365 productivity suite licenses" |
| Sold standalone? | The two Microsoft sources disagree. The Defender service description says it is "Available as a standalone license". The microsoft.com product page presents it only inside the Microsoft Defender Suite, requiring "Microsoft 365 E3; or Office 365 E3 and Enterprise Mobility + Security E3", and shows no standalone price |
| Minimum purchase | Not published by Microsoft |
| Term | Twelve months as sold by SourceIT |
Already Included In These Microsoft Plans
| Enterprise Mobility + Security | E5 |
| Microsoft 365 | E5, A5 and G5 |
| Microsoft Defender | Defender Suite, and the EDU, GOV and FLW variants |
| Microsoft Purview | Purview Suite, and the EDU, GOV and FLW variants; also Microsoft Defender + Purview Suite FLW |
| Information protection SKUs | Microsoft 365 E5, F5 and G5 Information Protection and Governance |
Data Residency and Retention
| Where the data sits | Microsoft states that tenants provisioned in the United States, European Union or United Kingdom are stored in those geographies. For every other tenant, which includes Singapore, the published wording is "The United States and/or a data center in the region that's nearest to the location of where the customer's Microsoft Entra tenant has been provisioned" |
| A second Microsoft page disagrees | The network requirements page lists only the US1, US2, US3, EU1 and EU2 data centres plus the government ones, with no Asia-Pacific data centre. The two pages do not reconcile |
| Retention | "Data from Microsoft Defender for Cloud Apps is retained for up to 180 days" |
What Microsoft Does Not Publish for This Product
The following are commonly asked about but are not stated on any current official Microsoft source for this product, so SourceIT does not quote them: a minimum seat count, any Singapore-specific data residency commitment, a mapping between the commerce SKU identifier and this product on any documentation page and a statement that this product was formerly named Microsoft Cloud App Security. We would rather leave a field blank than print a figure we cannot substantiate.
Lifecycle, End of Support and Entitlement
SourceIT sells this as a twelve-month subscription with a GST invoice in Singapore. The subscription is a right to use the service for the term, not a perpetual licence: when the term ends the entitlement ends unless it is renewed.
Microsoft publishes no dedicated lifecycle page for Defender for Cloud Apps, so no retirement date for the product as a whole can be quoted. One component retirement IS published, and it is a firm date: file policies retire on 6 January 2027, with file-based data protection moving to Microsoft Purview.
Talk to our team before the renewal date rather than after it. Seat counts, mid-term changes and co-terming with the rest of your Microsoft estate are all easier to arrange in advance, and we can quote the alternatives if a bundle would work out better for you.
Support and Entitlement Position
This is a software subscription, not hardware. It carries no hardware warranty, and any warranty term you see on a hardware listing does not apply here. What you are buying is a twelve-month right to use the service, together with SourceIT's local support in Singapore. Microsoft's own condition is that technical and billing support for a subscription bought through a partner runs through that partner, so for this subscription that means us: raise the ticket with SourceIT and we escalate to Microsoft where it needs to go. Renewal, seat changes and co-terming are handled on your SourceIT account. Ask our team for the current entitlement position in writing with your quotation.
Compatibility, Deployment and System Requirements
Check what you already own before you buy this. Several Microsoft 365 and Enterprise Mobility + Security bundles already include this service, and a tenant that buys it separately can end up paying twice for the same entitlement. Send us your current subscription list and we will check your existing entitlements before we quote.
Setting it up needs an administrator with sufficient rights. Microsoft: "To set up Defender for Cloud Apps, you must at least be a Security Administrator in Microsoft Entra ID or Microsoft 365." There is no agent to deploy to every endpoint — the service is portal-based and works through connectors, with Defender for Endpoint integration providing the endpoint signal for Cloud Discovery.
The one infrastructure requirement worth raising with your network team before you buy: Microsoft publishes a network requirements page listing outbound port 443 destinations that must be allowed to a documented set of DNS names, plus the addresses of your assigned data centre. If your outbound traffic is tightly filtered, check that list first.
Deployment Requirements
| Administrative role to set up | Security Administrator in Microsoft Entra ID or Microsoft 365, at minimum |
| Endpoint agent | None required. Defender for Endpoint integration supplies endpoint signal for Cloud Discovery |
| Network | Outbound port 443 to Microsoft's published DNS name set and your assigned data centre |
| Productivity licences | Not required, per Microsoft |
Official Microsoft Sources & Downloads
- What is Microsoft Defender for Cloud Apps (Microsoft Learn)
- Defender for Cloud Apps compared with Office 365 Cloud App Security (Microsoft Learn)
- Get started with Defender for Cloud Apps (Microsoft Learn)
- Defender for Cloud Apps data security and privacy (Microsoft Learn)
- Defender for Cloud Apps network requirements (Microsoft Learn)
- Defender for Cloud Apps release notes (Microsoft Learn)
- Microsoft Defender service description (Microsoft Learn)
- Microsoft Defender for Cloud Apps product page
- Modern Lifecycle Policy (Microsoft Learn)
Where a figure appears on this page it is quoted from one of these Microsoft pages; where Microsoft publishes nothing, this page says so rather than filling the gap. Supplied by SourceIT in Singapore with a GST invoice and local support. For a written quotation, current stock position or delivery lead time, contact our team.
Frequently Asked Questions — Defender for Cloud Apps Annual Subscription
We already have Microsoft 365 E5. Do we need this?
Almost certainly not as a separate purchase. Microsoft lists Defender for Cloud Apps as included in Microsoft 365 E5, A5 and G5, in Enterprise Mobility + Security E5, in the Microsoft Defender Suite and in the Microsoft Purview Suite. Send us your current subscription list and we will check it before quoting rather than sell you an entitlement you already hold.
Is this the same as the Cloud App Security we get with Office 365?
No, and the gap is wide. Office 365 Cloud App Security covers "750+ cloud apps" with manual log upload only and Office-only detection, session control and SIEM output, and supports only the Office 365 app connector. Full Defender for Cloud Apps covers "34,000 + cloud apps", adds automated log collection and API upload, cross-SaaS data loss prevention, session control for any cloud or on-premises app, and cloud platform security for Azure, AWS and Google Cloud.
Where will our data be stored?
Microsoft does not commit to Singapore. Its published rule for tenants outside the United States, European Union and United Kingdom is "The United States and/or a data center in the region that's nearest". A second Microsoft page, the network requirements page, lists only US and EU data centres and no Asia-Pacific one at all. The two pages do not agree, and we would rather show you both than pick the more comfortable one. If data location is a compliance requirement for you, get it in writing from Microsoft before you commit.
Do we need Microsoft 365 licences as well?
Not according to Microsoft, which states plainly that Defender for Cloud Apps "doesn't require Microsoft 365 productivity suite licenses". Note however that the microsoft.com product page presents the product inside the Microsoft Defender Suite with Microsoft 365 E3, or Office 365 E3 with Enterprise Mobility + Security E3, as a requirement. Which applies depends on the purchasing route, so ask us to confirm yours in writing.
Is there anything retiring that we should plan around?
Yes, one dated item. Microsoft has published that file policies retire on 6 January 2027 and that file-based data protection moves to Microsoft Purview, with existing file policies to be recreated as Purview data loss prevention or auto-labelling policies before that date. If file policies are central to your use case, plan the migration and talk to us about the Purview licensing alongside it.
