From CASB to SaaS Security: Tackling OAuth Threats with Microsoft Defender for Cloud Apps
Talking Security: Insights from Microsoft Security ExpertsShow Notes
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of the Talking Security Podcast, we sit down with Itai Cohen from the Microsoft Defender for Cloud Apps team to explore the evolution of SaaS Security — from the traditional CASB (Cloud Access Security Broker) model to a broader, more proactive security strategy. We cover: Why CASB isn’t enough anymore and what the future of SaaS Security looks like The growing threat of OAuth abuse — and why it’s such a hot target for attackers New innovations from Microsoft like Attack Path Analysis and Advanced Hunting for OAuth threats How Exposure Management is helping organizations proactively reduce SaaS risk 🎧 Whether you're a security architect, IT decision-maker, or Microsoft 365 enthusiast, this episode will help you rethink how you protect your SaaS environments. 👇 Don’t forget to like, subscribe, and share with your network. 📬 Got feedback or topics you'd like us to cover? Let us know in the comments or reach out via TalkingSecurity.nl!
Outline of the recording 0:00 - Intro 0:22 - Introduction of this episode 2:05 - Introduction of Itai Cohen - Microsoft 2:29 - What was the original goal of Microsoft Defender for Cloud Apps as a CASB solution? 4:10 - Why is Microsoft adding more capabilities on top of the traditional CASB model towards a broader SaaS Security approach? 6:08 - How do you see today’s SaaS threat landscape compared to when CASB solutions first appeared? 10:11 - Why is OAuth has become such an attractive attack vector? 13:53 - What are typical OAuth attack paths, and how do attackers exploit them? 14:50 - Microsoft blog - https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/protect-saas-apps-from-oauth-threats-with-attack-path-advanced-hunting-and-more/4395997-, you announced new capabilities to detect OAuth threats. Can you give us an overview of what’s new? 16:16 - How does Attack Path Analysis help customers better understand and mitigate OAuth risks? 19:10 - Advanced Hunting is now available for OAuth threats — how can security teams leverage this capability? 22:36 - What are some common mistakes you see organizations make when it comes to OAuth permissions and consent management? 26:40 - Exposure Management - How does Microsoft Defender for Cloud Apps contribute to a broader exposure management approach, and how can customers use it 31:47 - How do you see the role of SaaS Security evolving within the wider Exposure Management strategy that Microsoft is building? 33:09 - How does SaaS Security fit into Microsoft’s broader security strategy, alongside Defender XDR and Entra ID? 35:33 - SaaS Security is overlooked? Why? 40:42 - If you weren’t working in security, what would you be doing instead? 42:20 - Closing the episode 43:23 - Outro
#SaaSSecurity #MicrosoftDefender #OAuth #CASB #CloudSecurity #TalkingSecurityPodcast
More from Talking Security: Insights from Microsoft Security Experts
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! How do you secure AI agents in Microsoft Entra? Security MVP Derk van der Woude explains agent identity blueprints, classic vs modern agents and Agent 365. In the relaunch of MVP Security Insights, Frans and Pouyan talk with Derk about AI agent security from both the attacker and the defender side.
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! Join Frans Oudendorp and Pouyan Khabazi in this special episode of Talking Security – Let’s Talk, where we sit down with Javier Soriano, Principal Product Manager for Microsoft Sentinel. We dive deep into: - The evolution of Sentinel from day zero to today - The new Sentinel Data Lake and how it transforms long-term log retention and investigations - Why Sentinel Graph matters for SOC teams - The Model Context Protocol (MCP) and its role in agentic AI workflows - What’s next for cloud-native security: automation, AI, and new operating models If you’re curious about the future of Microsoft Sentinel and want practical insights for your security team, this episode is packed with value.
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Talking Security – MVP Security Insights, we sit down with Ronny de Jong to explore his remarkable journey from cybersecurity MVP to his current role at Microsoft. Ronny shares insights on: 💎 His career path and what inspired him to join Microsoft 💎 The unique cybersecurity challenges facing governments and public institutions 💎 How Microsoft’s security portfolio supports national resilience 💎 Balancing innovation, compliance, and operational realities in the public sector 💎 Future trends in threat intelligence and security operations 💎 Practical advice for aspiring cybersecurity professionals 💎 The meaning of true cyber resilience and moving from reactive to proactive security
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Let’s Talk, part of the Talking Security podcast, Frans Oudendorp and Pouyan Khabazi break down the biggest announcements from Microsoft Secure 2025. We explore how Microsoft Sentinel is evolving into an agentic AI platform, the introduction of Sentinel Graph and Model Context Protocol (MCP), and how Security Copilot agents are changing the game for SecOps automation. You’ll also hear about: Graph-based context and why it matters for threat detection Developer extensibility for custom connectors and AI agents Sentinel Data Lake for affordable long-term storage Real-world use cases for agentic AI in security operations Plus, we share community highlights, upcoming events like YellowHat 2025 and KustoCon, and a fun geeky quiz to wrap things up. 👉 Question for you: If you could build your own Security Copilot agent, what would it do? Let us know! 🎙️ Stay safe, stay secure, and keep talking security!
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Talking Security – MVP Security Insights, Frans Oudendorp and Pouyan Khabazi sit down with Eric Woodruff—Chief Identity Architect at Semperis and long-time identity expert—to explore his journey from managing Active Directory in the public sector to shaping cutting-edge identity strategies in the cloud era. Eric shares what it means to truly be “in” cybersecurity, the evolving role of Entra ID, and the significance of identity research like the UnOAuthorized project. We also dive into global challenges in identity management, the balance between strong security and business agility, and how community collaboration through IDPro is driving vendor-agnostic progress. Whether you're new to identity or a seasoned expert, this conversation is packed with real-world insights, practical advice, and forward-looking trends shaping the future of identity and access management.