Security guide

What Is a CASB? Cloud Access Security Broker Explained

A cloud access security broker (CASB) is the control point for how your people use SaaS. It finds the apps they use (including ones you never approved), assesses their risk, protects the data inside approved apps and limits what a session can do. Microsoft describes the fundamental CASB functions as shadow IT discovery, visibility into cloud app usage, protection against app-based threats and information protection with compliance assessments.

This guide explains the four jobs, the difference between API and inline deployment, what a CASB cannot do and how to start. Product behaviour is taken from Microsoft Defender for Cloud Apps documentation read on 4 November 2026, because it is public and detailed; other products differ in settings but share the ideas.

Updated 4 November 2026 (last reviewed)

TL;DR

The short version

5 points

A CASB covers four jobs: discover SaaS use, protect data in approved apps, stop app-based threats and show compliance posture.
Discovery works from traffic logs checked against an app catalog; unsanctioning an app alone does not block it.
API connections govern content at rest; inline session control acts in real time, including from unmanaged devices. Most programmes need both.
OAuth apps are a threat path of their own: investigate by purpose, permissions and publisher, and use policy, not user vigilance.
Know the limits: catalog gaps, browser-only session controls, tuning effort and changing product features.

The four jobs of a CASB

Discover. Cloud discovery analyses web traffic logs against a catalog of cloud apps and ranks each by risk factors (Microsoft cites more than 90). It can run as a one-off snapshot of uploaded logs or as a continuous report fed from endpoints, log collectors or a secure web gateway.
Protect data. DLP policies find sensitive content in stored files and in motion, and respond by labelling, restricting sharing or blocking an activity.
Stop threats. Anomalous behaviour, malware in uploads and risky OAuth apps. Microsoft calls out OAuth apps because they often behave unnoticed while holding wide permissions to data in other apps.
Show posture and compliance. Many products also check SaaS app configuration against recommendations; Microsoft calls this SaaS security posture management.

Sources (accessed 4 November 2026): Defender for Cloud Apps overview; Cloud discovery overview.

API-based versus inline: pick by job

Question	API connection	Inline session control
What it sees	Content and sharing already stored in the app, via the provider's APIs	Activities in a user's live browser session
When it acts	After the fact, continuously	In real time
Typical use	Find publicly shared files, apply labels, remove external collaborators	Block downloads of sensitive files to unmanaged devices, require labels on upload
Device agent	None	None; users are redirected through a reverse proxy, or protected in the browser for some Edge users

The columns are the two halves of Microsoft's description: file policies are API-based, and Conditional Access app control uses access and session policies for browser sessions. The row on typical use and the advice to combine them are our reading, not a vendor statement.

Sources (accessed 4 November 2026): File policies; Conditional Access app control; Session policies.

Sanction, unsanction, block: three different things

Sanctioned means approved; unsanctioned means unwanted. Microsoft is explicit that unsanctioning does not by itself block use: it lets you monitor the app and notify users with an alternative. Blocking uses the endpoint integration, supported gateways, or a block script imported into your own appliance. Apps connected by API or onboarded to the inline proxy appear as sanctioned in cloud discovery. Some Microsoft services cannot be blocked this way, to prevent downtime.

Sources (accessed 4 November 2026): Govern discovered apps.

OAuth apps: the quiet threat path

When a user clicks accept on a consent screen, a third-party app gets a token for their data without their password. Microsoft's investigation advice: the more common an app is, the safer it is likely to be; an app should only need permissions related to its purpose; and apps asking for high privileges or admin consent are more likely to be risky. Remediation is to ban or revoke the app, by hand or by policy. Because users often accept without reading, build alerts on high-permission apps and review stale authorisations. Practise in the OAuth Consent Lab.

Sources (accessed 4 November 2026): Risky OAuth apps.

What a CASB cannot do

Discovery by default cannot show apps that are not in its catalog; add custom apps for the gaps.
Session controls apply to interactive browser sessions. Microsoft states the Teams desktop application is not supported for them, so you restrict that sign-in path separately.
Access policies apply at application level, not to individual files.
When two session policies conflict, the more restrictive wins.
Noisy DLP policies are tuned by narrowing filters, raising minimum match counts and previewing results, not by switching them off.
Features retire: Microsoft states its file policies retire on 6 January 2027 and advises migrating to Purview DLP or auto-labelling. Check the roadmap of whatever you run.

Sources (accessed 4 November 2026): Cloud discovery overview; Conditional Access app control; Session policies; File policies.

CASB, CSPM, SWG and CNAPP in one table

This table is PlayCISO's framing to help you place the acronyms; vendors bundle these differently.

Control	Main question	Assets
CASB	Who uses which SaaS app, and what happens to our data there?	SaaS apps, users, files, OAuth grants
CSPM	Are our cloud accounts configured safely?	IaaS and PaaS resources, identities
Secure web gateway	Which web destinations may users reach?	Web traffic
CNAPP	One platform for cloud workloads and posture	Workloads, code, cloud

See What is CSPM? and the CNAPP guide for the infrastructure side.

How to start in four steps

Turn on continuous discovery from the data you already have (endpoint agent, proxy or firewall logs) and read the top apps by users and data volume.
Decide sanctioned and unsanctioned with business owners, name an alternative for each unsanctioned app, then enforce.
Connect your top two or three sanctioned apps by API and add OAuth app alerts and a DLP policy in alert-only mode; tune before any irreversible action.
Add session controls for unmanaged devices and contractors, test in report-only mode, and check each client type.

Then rehearse the decisions in the CASB Lab.

Frequently asked questions

What does CASB stand for?

Cloud access security broker. It is a control point between users and the cloud apps they use, giving visibility into what is used and controls over data and sessions inside those apps.

What are the main functions of a CASB?

In Microsoft's description of Defender for Cloud Apps, the fundamental CASB functions are shadow IT discovery, visibility into cloud app usage, protection against app-based threats and information protection with compliance assessments. Products often add SaaS posture checks and OAuth app governance.

What is the difference between an API-based and an inline CASB?

API-based control connects to the app's own APIs and can scan and govern content already stored there. Inline control sits in the user's session, for example through a reverse proxy, and can act in real time on activities such as downloads. Many programmes use both.

Does a CASB block shadow IT?

Discovery alone only shows it. In Microsoft's documentation, marking an app unsanctioned lets you monitor it; blocking needs an enforcement path such as the endpoint integration, a supported gateway or a block script for your own appliance.

Is a CASB the same as CSPM?

No. A CASB governs how people use SaaS apps and the data in them. CSPM checks the configuration of cloud infrastructure accounts. The two overlap in the idea of posture, and some vendors bundle them, but the assets differ.

What are the limits of a CASB?

Discovery cannot show apps missing from its catalog by default, session controls apply to browser sessions and some desktop clients are not covered, and policies need tuning or they drown the team in false positives. Product features also change: Microsoft states that its file policies retire on 6 January 2027, with migration to Purview DLP advised.

How do I practise CASB decisions?

Try the free CASB Lab: eleven scored decisions on a fictional SaaS-sprawl case, from shadow IT discovery to session control.