CASB Lab: Shadow IT, OAuth Risk, DLP, Session Control
You run a CASB programme for a fictional company, one decision at a time. Find the SaaS apps nobody told you about, decide which to sanction, choose between API and inline control, deal with a risky OAuth app, tune a DLP policy that cries wolf and protect contractor sessions on unmanaged devices. New to the term? Read What is a CASB? first.
You are Priya Raman, the security lead at Northwind Logistics, a fictional logistics company (northwind.example) whose staff have adopted dozens of SaaS apps without asking. Across 11 decisions you discover shadow IT, decide which apps to sanction, choose between API and inline deployment, handle a risky OAuth app, tune a DLP policy and set session controls for contractors. Everything is fictional: the company, the apps and the numbers in the story. No commands or configuration appear. Each call is scored 0 to 10, with the vendor documentation behind the rationale; product behaviour is cited from Microsoft Defender for Cloud Apps documentation because it is publicly documented, and other CASB products work on the same ideas.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab for security leads and analysts: a fictional logistics company (northwind.example) has SaaS sprawl, and you make 11 scored decisions to bring it under control.
- Topics: shadow IT discovery and catalog gaps, sanctioned versus unsanctioned apps, why a tag is not a block, API connector versus inline proxy, risky OAuth apps, DLP tuning and governance actions, session policies for unmanaged devices, client coverage gaps and policy conflicts.
- Every rationale cites the vendor documentation behind it, read on 4 November 2026. Where a step is PlayCISO practice rather than a vendor statement, the feedback says so.
- Free to play, no sign-up needed to run it. A final score and grade, a shareable scorecard and next-step links.
- Defensive and educational only. Every company, app and number in the story is fictional, and nothing connects to a real tenant.
How this lab differs from the neighbours
The OAuth Consent Lab drills one consent flow, the SaaS Security Assessment scores your own posture, and the Cloud Posture Lab is about cloud infrastructure settings. This lab is about the SaaS layer: who uses what, what the business should approve, and how to control data and sessions inside approved apps. For the infrastructure view, try the CSPM Triage Lab; for the platform category, see the CNAPP guide.
Frequently asked questions
What is a CASB?
A cloud access security broker sits between your people and the SaaS apps they use. The CASB functions Microsoft lists for Defender for Cloud Apps are shadow IT discovery, visibility into cloud app usage, protection against app-based threats and information protection with compliance assessments. This lab practises those functions on a fictional company.
What does the CASB Lab teach?
Eleven decisions: how to feed discovery, what to do about apps outside the catalog, how to sanction and unsanction, why unsanctioning is not blocking, when to use API connectors versus inline session control, how to investigate a risky OAuth app, how to stop the next one, how to tune a noisy DLP policy, how to act on a real match, how to protect contractor sessions on unmanaged devices and how to find coverage gaps.
Does unsanctioning an app block it?
Not by itself. In Microsoft's documentation, unsanctioning lets you monitor an app and notify users; blocking comes from the endpoint integration, certain secure web gateways, or a block script you import into your own appliance.
API-based or inline CASB: which one do I need?
Usually both, for different jobs. API connections let policies scan content already stored in an app and govern sharing, while inline session control acts in real time on browser sessions, including from unmanaged devices, without installing anything on the device. The lab makes you choose for a fictional file-sharing app.
Which product is the lab based on?
Behaviour is cited from Microsoft Defender for Cloud Apps documentation because it is public and detailed. The ideas (discovery, sanctioning, API and inline control, DLP, OAuth governance) apply to other CASB products, whose settings differ. The lab does not connect to any product or tenant.
How is it different from the OAuth Consent Lab or the SaaS Security Assessment?
The OAuth Consent Lab goes deep on one consent flow, and the SaaS Security Assessment scores your own posture. This lab is the CASB programme view: discovery, governance, DLP and session control across a fictional SaaS estate.
Can I download my debrief?
The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.
Sources
Read on 4 November 2026. Written in our own words; no vendor or standards text is reproduced.
- Microsoft Learn: Overview, Microsoft Defender for Cloud Apps
- Microsoft Learn: Cloud app discovery overview (Defender for Cloud Apps)
- Microsoft Learn: Govern discovered apps (Defender for Cloud Apps)
- Microsoft Learn: Investigate and remediate risky OAuth apps (Defender for Cloud Apps)
- Microsoft Learn: Conditional Access app control (Defender for Cloud Apps)
- Microsoft Learn: Create session policies (Defender for Cloud Apps)
- Microsoft Learn: File policies in Microsoft Defender for Cloud Apps
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.