MCAS
Microsoft Defender for Cloud Apps (formerly MCAS) discovery module.
What it does
Discovers MCAS policies, alerts, and connected cloud applications through the Microsoft Graph Security API. Exports CSVs for M&A assessment: - MCASAlerts.csv : security alerts attributed to Defender for Cloud Apps - MCASConnectedApps.csv : OAuth-connected/sanctioned SaaS applications - MCASSecureScore.csv : tenant security posture (Defender control profiles) - MCASSaaSInventory.csv : normalized SaaS inventory (risk score, user count, sanctioned/monitored flags) for Snow Atlas parity Enriched with pure testable mapper functions and multi-strategy collection strategies with graceful fallback support.
How the app exposes it
The module runs through the ACQI discovery orchestrator and writes its rows into a dedicated results view. From there, conflicts, dependencies, and readiness scores feed the deal-wide consolidation layer.
/discovered/mcas Outputs
Each module emits a normalised CSV keyed by entity ID with readiness and risk scores, evidence-source counts, and last-seen timestamps. The exact column set varies by module — the app's results view shows the live schema.