A contractor needs to read a design brief in a company workspace. The company approves that access but wants to keep the document off the contractor’s personal laptop. The next morning, a project lead shares a different brief from the same workspace through a public link. Meanwhile, someone uploads a third copy to a personal account. The files look identical. Each travels through a different path, and a control on one path may never see the other two.
Cloud access security brokers (CASB) give security teams visibility into cloud application use and ways to enforce policy on supported activity. The buying decision starts with a deceptively simple question. Where can the product see and act on each event? A good evaluation separates what happens in transit, what already exists in a managed tenant and what can only be inferred from traffic records.
Discovery shows where to investigate
Cloud discovery starts with observable traffic. Logs from endpoints, firewalls or gateways can reveal visits to cloud services, including apps nobody submitted for approval. That helps a security team replace a vague conversation about shadow IT with a conversation about actual workflows. An app with high usage may warrant approval and guardrails, especially if it fills a gap that the approved alternative leaves open.
A discovery report rarely answers every question about the underlying activity. A domain can serve several services or tenants, and a request can indicate background synchronization as easily as deliberate user activity. Before acting on an app rating, ask whether the tool can identify a corporate instance separately from a personal one and which users and devices contribute data. Mark traffic sources that never reach the collector. An empty report for an uninstrumented group is an unknown.
A useful first deliverable is a short register of high-priority apps with a business owner, an observed use, a decision and a follow-up date. Give owners a way to correct mistaken labels. Test a notification on one department before using a block rule across the workforce. That sequence makes the discovery process a source of decisions with accountable owners.
Session controls decide what users can do now
An inline control observes a supported session as traffic passes through an enforcement point. It can apply a decision to a specific action, such as a download in a browser session, while allowing other permitted activity. This is the plane to test when the requirement is to let the contractor read the brief and stop it from landing on the laptop.
Microsoft documents access and session policies in Defender for Cloud Apps Conditional Access app control. Its deployment guidance includes identity-provider integration and app onboarding. That makes it a concrete evaluation example for a team that wants to see how authentication leads into a controlled session. Read the onboarding conditions for the actual app and test the exact action the contractor needs to take. Microsoft Defender for Cloud Apps documentation
Browser, mobile and desktop clients can follow different paths. A user may see a policy on a browser download and find the same document available through a native sync client. An integration using delegated credentials may have its own route. Run the test with a managed browser, an unmanaged browser and any relevant native client. Capture a permitted event, a denied event and the log that an analyst would receive for each.
Pay attention to how people experience denial. A blank browser window and a clear message about opening the file on a managed device create different support burdens. Test uploads, previews and business-critical workflows such as editing in the browser. When a control relies on traffic steering, add a test for a client that drops off the expected route. Document which component handles that condition and who gets notified.
Tenant connectors find risks that already exist
An API connector works against the service’s supported interfaces. It can bring stored objects, activity or configuration into view depending on the app and permissions granted. A connector may help identify an existing public link, classify a stored document or surface a risky integration. Timing varies with the service, event delivery and scanning design, so measure the delay between creating a test exposure and seeing the result.
Start by reviewing the connector’s permissions with the SaaS owner. Determine what information leaves the tenant, how the tool handles downloaded content and whether it can alter permissions. Run a read-only pilot when that option is available. Then demonstrate remediation on controlled data and record whether the action affects a specific link, an individual collaborator or the object’s broader sharing settings.
A report of open links becomes much more useful if it includes the resource owner and the business context. Some public files are intentional, including product collateral and event information. Create an exception with a named owner, an expiry and a scope that can be audited. A blanket exemption for an entire app makes it harder to detect the next exposed file.
A test plan that exposes the differences
| Scenario | Expected result | Evidence to capture |
|---|---|---|
| Contractor opens a labeled file in an unmanaged browser | Preview succeeds and the download policy applies | Session event, rule name and user message |
| Employee shares a test document from a managed tenant | Connector detects or remediates the test link | Original permissions, scan time and final permissions |
| Employee visits an unapproved file transfer app | Discovery identifies the observed use | Source coverage, user mapping and app or tenant identifier |
| Sync client attempts the same download | The team can explain the actual outcome | Route, relevant logs and any separate endpoint control |
Run these tests with approved synthetic documents. Define the expected outcome and acceptable delay before demonstrating the tool, and include ordinary allowed behavior alongside edge cases. Compare vendors on the same enforcement path with the same event and policy.
Buy coverage your team can operate
Document adjacent responsibilities while the architecture is still easy to change. Identity teams own sign-in and device signals. SaaS owners control application settings. Endpoint teams may handle clipboard, sync or local storage. The CASB team can connect detections and enforcement for specific cloud actions, with ownership agreed for each action that crosses a boundary.
Also price the operational work. The relevant costs can include subscriptions, traffic routing, app onboarding, log storage, label maintenance and an analyst’s time spent checking alerts. Ask for the cost of onboarding your second tenant, supporting guests and handling SaaS changes after rollout. If most high-value work happens in two applications, obtain precise coverage for those two before paying for a broad catalog.
Plan for people who challenge a policy. Store the evidence needed to reproduce a decision and give support a path to escalate a legitimate exception. Define who can turn a policy off, how they record the change and how the team restores protection. Where the business depends on continuous access, test the fallback under supervision.
Follow an exception through its expiry
Suppose the contractor must retain one drawing overnight to complete a field visit where connectivity is unreliable. The app owner proposes a temporary exception for that document and contractor. Ask how the CASB expresses the scope, how the security team checks it and which controls still apply once the file reaches a device. If the product can only exempt the entire app or account, the business decision changes. Record that difference before approving the policy.
After the exception expires, run the same session again. Show which rule denies the download and which audit record distinguishes a temporary decision from an enduring configuration change. Then ask support to locate that decision using only the user’s reported time and app name. The exception has a manageable lifecycle when those three groups can all work from the same record.
Put the pilot’s map of actions and enforcement points beside the quote. It should show which sessions the team can control, which exposures it can remediate afterward and where another owner must take responsibility. Trace the contractor’s download, the public link and the personal upload to an actual decision before committing to coverage.