Microsoft Cloud App Security
Microsoft Cloud App Security is a Cloud Access Security Broker (CASB) that supports various deployment modes including log collection, API connectors, and reverse proxy. It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyberthreats across all your Microsoft and third-party cloud services.
Permissions
Microsoft Cloud App Security will be able to do:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Developer
Microsoft
Company headquarters location
United States
Privacy & data governance
Data retention policy
Cloud App Security retains data as follows:
Activity log: 180 days
Discovery data: 90 days
Alerts: 180 days
Governance log: 120 days
For more info: https://docs.microsoft.com/en-us/cloud-app-security/cas-compliance-trust#data-retention
Data archiving and removal policy
After data is deleted from a connected cloud application, Cloud App Security will automatically delete the copy of the data within 2 years.
For more information: https://docs.microsoft.com/en-us/cloud-app-security/cas-compliance-trust#deleting-personal-data
Data storage policy
Cloud App Security currently operates in datacenters in the European Union, the United Kingdom, and the United States (each a "Geo"). Customer data collected by the service is stored at rest as follows (a) for customers whose tenants are provisioned in the European Union or the United Kingdom, in either the European Union or the United Kingdom; (b) else, a data center in the Geo that is nearest to the location of where the customer's Azure Active Directory tenant has been provisioned; or (c) if Cloud App Security uses another Microsoft online service (such as Azure Active Directory or Azure CDN) to process such data, the data geolocation will be as defined by the data storage rules of that other online service.
For more information: https://docs.microsoft.com/en-us/cloud-app-security/cas-compliance-trust#data-location
App/service has sub-processors
no
Certifications & compliance
Data deletion request procedure
Through our support ticket process.
HIPAA compliant
yes
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Date of latest pen test
2021-04-26
Executive summary is available to potential customers upon request
yes
Supports Single Sign On (SSO) with the following providers
Azure AD.
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
yes
Contact for security issues
casfeedback@microsoft.com
Has a vulnerability disclosure program
yes
Vulnerability disclosure program URL
Vulnerability disclosure program covers Slack app
yes
Has a bug bounty program
yes
Bug bounty program URL
Requires third party authorization/connections
no
Uses token rotation
yes