Entra Agent Id
microsoft/GitHub-Copilot-for-Azure
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant)…
Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection.
Install Defender For Cloud Apps
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-cloud-apps --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/defender-for-cloud-apps .claude/skills/defender-for-cloud-apps && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "defender-for-cloud-apps" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-apps into .claude/skills/defender-for-cloud-apps/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-cloud-apps", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-appsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-cloud-apps --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/defender-for-cloud-apps .agents/skills/defender-for-cloud-apps && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "defender-for-cloud-apps" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-apps into .agents/skills/defender-for-cloud-apps/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-cloud-apps", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-cloud-apps --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/defender-for-cloud-apps .cursor/skills/defender-for-cloud-apps && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "defender-for-cloud-apps" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-apps into .cursor/skills/defender-for-cloud-apps/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-cloud-apps", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/vinayaklatthe/microsoft-security-skills.git --path skills/defender-for-cloud-apps--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-cloud-apps --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/defender-for-cloud-apps .gemini/skills/defender-for-cloud-apps && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "defender-for-cloud-apps" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-apps into .gemini/skills/defender-for-cloud-apps/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-cloud-apps", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-cloud-appsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/defender-for-cloud-apps .github/skills/defender-for-cloud-apps && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "defender-for-cloud-apps" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-apps into .github/skills/defender-for-cloud-apps/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-cloud-apps", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install vinayaklatthe/microsoft-security-skills defender-for-cloud-apps --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/defender-for-cloud-apps .opencode/skills/defender-for-cloud-apps && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "defender-for-cloud-apps" agent skill from https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-apps into .opencode/skills/defender-for-cloud-apps/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "defender-for-cloud-apps", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
defender-for-cloud-apps- GitHub stars
- 175
- Token cost
- ~1.9k tokens
- SKILL.md length
- 806 words
- Files
- 1
- Skills in repo
- 50
- Repo updated
- First seen
- Licence
- MIT
At a glance
Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection.
- Works in 7 steps: Enable Cloud Discovery via MDE —… → Triage the Cloud App Catalog — Sort by… → Connect sanctioned SaaS via app… → …
- IaaS / PaaS posture (use defender-for-cloud-hardening)
- SKILL.md covers When to use, Pick the MDA capability, Approach and Guardrails, plus 3 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Defender For Cloud Apps is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection. Covers Cloud Discovery via Defender for Endpoint integration, OAuth app governance, Conditional Access App Control (reverse-proxy session policies), and SaaS security posture (SSPM). WHEN: Defender for Cloud Apps, MDA, CASB, shadow IT discovery, cloud app governance, OAuth app risk, session control, Conditional Access App Control, SaaS security posture management, SSPM…
Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Cloud networking and OAuth and OpenID Connect. It works with Microsoft Defender and Microsoft 365. The repository describes itself as: Curated Microsoft Security skills for AI agents - Defender, Sentinel, Entra, Purview, Intune, Security Copilot. The licence is MIT.
When your agent uses it
- IaaS / PaaS posture (use defender-for-cloud-hardening)
- Endpoint EDR (use defender-for-endpoint)
- DLP (use purview-dlp-policy)
Example prompts
- “/defender-for-cloud-apps”
Workflow steps
7 steps, taken from the first numbered list in SKILL.md.
- Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on.
- Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved
- Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow,
- Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS
- Conditional Access App Control - pilot session policies — Reverse-proxy session
- Anomaly detection + alert tuning — Default policies (impossible travel, mass
- Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the
What it can do on your machine
Read from SKILL.md and the folder at commit 15f16df. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
learn.microsoft.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Defender For Cloud Apps loads about 1.9k tokens when it runs. Until then it costs about 186 tokens; SKILL.md has 806 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from vinayaklatthe/microsoft-security-skills at commit 15f16df, republished under its MIT licence (© vinayaklatthe). 806 words, ~1,920 tokens.
Download SKILL.mdSave it as
.claude/skills/defender-for-cloud-apps/SKILL.md (or your agent's skills folder).- name
- defender-for-cloud-apps
- description
- Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection. Covers Cloud Discovery via Defender for Endpoint integration, OAuth app governance, Conditional Access App Control (reverse-proxy session policies), and SaaS security posture (SSPM). WHEN: Defender for Cloud Apps, MDA, CASB, shadow IT discovery, cloud app governance, OAuth app risk, session control, Conditional Access App Control, SaaS security posture management, SSPM, sanction or unsanction app, Cloud App Catalog, app connectors. DO NOT USE for IaaS / PaaS posture (use defender-for-cloud-hardening), endpoint EDR (use defender-for-endpoint), or DLP (use purview-dlp-policy).
- license
- MIT
- metadata.author
- Microsoft
- metadata.version
- 0.1.0
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) and SaaS security solution providing visibility into cloud app usage, governance of OAuth-connected apps, real-time session controls via Conditional Access App Control, and threat detection across connected SaaS services.
When to use
Discovering shadow IT, governing OAuth apps connected to Microsoft 365, applying in-session controls, and managing SaaS posture (SSPM). Use this skill when the question is about applications (SaaS or third-party), not IaaS or endpoints.
Do not use this skill for IaaS / PaaS posture (defender-for-cloud-hardening), EDR
(defender-for-endpoint), or DLP authoring (purview-dlp-policy).
Pick the MDA capability
| Goal | Capability | Notes |
|---|---|---|
| Find unsanctioned cloud apps in use | Cloud Discovery via MDE integration | Agentless; uses MDE telemetry |
| Get activity / file visibility for sanctioned SaaS | App connector (API-based) | M365, Salesforce, ServiceNow, Workday |
| Govern OAuth apps connected to Microsoft 365 | App governance add-on | Risk score + automated policies |
| Block file download in browser session | Conditional Access App Control (session) | Reverse proxy; integrates with CA |
| Detect anomalous user activity (impossible travel, mass download) | Anomaly detection policies | UEBA-style |
| Posture for connected SaaS (config drift) | SaaS Security Posture Management (SSPM) | Per-app recommendations |
| Investigate / contain a compromised SaaS account | Governance actions | Suspend, force re-auth, revoke OAuth |
Rule of thumb: start with Cloud Discovery via MDE (free with E5) to find shadow IT and app governance for OAuth risk - those two cover 80% of the SaaS attack surface. Session control via CAAC is powerful but the reverse proxy adds operational surface area; pilot it narrowly.
Approach
Enable Cloud Discovery via MDE — Integration → Microsoft Defender for Endpoint → on. No agents, no log uploads - discovery happens automatically from MDE telemetry on managed endpoints. Verify: Discovery dashboard populates within 24-48 hours; app catalogue scores visible.
Triage the Cloud App Catalog — Sort by risk score + user count. Sanction approved apps; unsanction risky / unused apps (MDE then blocks them on managed endpoints). Verify: top 10 high-user-count high-risk apps reviewed weekly.
Connect sanctioned SaaS via app connectors — Microsoft 365, Salesforce, ServiceNow, Workday, GitHub Enterprise via API connector. Provides activity log, file inventory, admin / user account governance.
Turn on app governance for OAuth risk — Microsoft Graph permissions are the SaaS blast radius. App governance scores third-party OAuth apps by risk and permission privilege. Auto-policy: block apps requesting > X high-privilege permissions or unverified publisher. Verify: app governance shows risk distribution; high-risk apps either approved or blocked, not lingering.
Conditional Access App Control - pilot session policies — Reverse-proxy session control for browser sessions to cloud apps. Use cases: block download on unmanaged devices, force document-labeling on upload, monitor copy/paste. Verify: a session from an unmanaged device shows the watermark / download block; from a compliant device, no friction.
Anomaly detection + alert tuning — Default policies (impossible travel, mass download, multiple failed sign-ins, ransomware activity). Tune thresholds; stream to Defender XDR for unified incident view.
Operationalise — Stream MDA alerts into XDR / Sentinel. Define playbooks for the top 5 alert types (impossible travel, mass download, OAuth consent granted, file externally shared, admin activity from unusual location).
Show full SKILL.md (300 more words)Show less
Guardrails
- Cloud Discovery data can include user activity - set anonymisation per privacy requirements. EU works councils may require user anonymisation in the discovery view.
- Pilot session policies; reverse-proxy session control can affect app behaviour. Some SaaS app features break under the reverse proxy. Test thoroughly per app.
- Prioritise app governance for apps with broad Microsoft Graph permissions. Mail.Read
- Files.Read.All for a third-party app = data-exfil risk on first compromise. Review before consent or auto-block.
- Sanction state matters. Unsanctioning blocks via MDE - confirm impact before flipping high-user apps.
- OAuth consent should be admin-only for most permissions. User-consent for high- privilege scopes is a phish-then-consent route.
- MDA isn't DLP. Use Purview DLP for content-aware policies; MDA for context (session, app, device).
Common anti-patterns
- "Discover apps but never sanction" - Visibility without action. Sort by risk, decide.
- "Auto-block all newly discovered apps" - User outrage; legitimate apps blocked. Review then sanction / unsanction.
- "OAuth governance later - it's just app permissions" - First compromised OAuth app with Mail.Read = mass exfil. Govern from day one.
- "Session policies on every app" - Pilot one app; broaden carefully.
- "Ignore the privacy / works-council angle" - Discovery rollout blocked by HR or legal mid-flight. Anonymisation question is the first one.
- "MDA alerts not in XDR / Sentinel" - Analysts miss them. Stream by default.
Example prompts
Discover shadow IT via Defender for Endpoint integration and sanction or unsanction cloud apps.Set up Conditional Access App Control session policies for unmanaged devices.Assess OAuth app risk with app governance and block high-risk consents.Connect Microsoft 365 and Salesforce via app connectors for full activity visibility.Tune impossible-travel and mass-download anomaly policies.Stream MDA alerts into Defender XDR for unified investigation.
Microsoft Learn
- MDA overview: https://learn.microsoft.com/defender-cloud-apps/what-is-defender-for-cloud-apps
- Cloud Discovery: https://learn.microsoft.com/defender-cloud-apps/set-up-cloud-discovery
- MDE integration for Discovery: https://learn.microsoft.com/defender-cloud-apps/mde-integration
- App governance: https://learn.microsoft.com/defender-cloud-apps/app-governance-manage-app-governance
- Conditional Access App Control: https://learn.microsoft.com/defender-cloud-apps/proxy-intro-aad
- App connectors: https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
- Anomaly detection: https://learn.microsoft.com/defender-cloud-apps/anomaly-detection-policy
- SSPM: https://learn.microsoft.com/defender-cloud-apps/security-saas
© vinayaklatthe, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/defender-for-cloud-apps of vinayaklatthe/microsoft-security-skills.
Open the folder on GitHubat commit 15f16df
Compare with similar skills
Defender For Cloud Apps next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Defender For Cloud Apps this skillvinayaklatthe/microsoft-security-skills | 175 | — | ~1.9k | Automated safety check: Pass | MIT | |
| Entra Agent Idmicrosoft/GitHub-Copilot-for-Azure | 255 | 2 repos | ~4k | Automated safety check: Pass | MIT | |
| Detecting OAuth Token Theftmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3.2k | Automated safety check: Pass | Apache-2.0 | |
| Implementing API Threat Protection With Apigeemukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | |
| Implementing Zero Trust For SaaS Applicationsmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| API GatewayCraftOS-dev/CraftBot | 392 | 3 repos | ~7.1k | Automated safety check: Pass | MIT |
Similar skills
- Official
Detecting OAuth Token Theft
mukul975/Anthropic-Cybersecurity-Skills
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks…
Implementing API Threat Protection With Apigee
mukul975/Anthropic-Cybersecurity-Skills
Implements API threat protection using Google Apigee reverse-proxy policies, including JSON/XML threat protection, OAuth 2.0 enforcement, SpikeArrest rate limiting, regex-based threat detection, and…
Implementing Zero Trust For SaaS Applications
mukul975/Anthropic-Cybersecurity-Skills
Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity…
API Gateway
CraftOS-dev/CraftBot
Connect to 100+ APIs (Google Workspace, Microsoft 365, Notion, Slack, Airtable, HubSpot, etc.) with managed OAuth.
Detecting Email Account Compromise
mukul975/Anthropic-Cybersecurity-Skills
Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule…
More from vinayaklatthe/microsoft-security-skills
All 50 skills in this repoAPI Security Design
vinayaklatthe/microsoft-security-skills
Guidance for designing secure APIs on Azure - authentication, authorization, gateway controls, input validation, rate limiting, secret management, and runtime threat detection - aligned to OWASP API…
Azure App Service Security
vinayaklatthe/microsoft-security-skills
Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening…
Azure Arc
vinayaklatthe/microsoft-security-skills
Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management.
Azure Bastion Jit
vinayaklatthe/microsoft-security-skills
Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access.
Azure Confidential Computing
vinayaklatthe/microsoft-security-skills
Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs).
Azure Ddos Protection
vinayaklatthe/microsoft-security-skills
Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform.
Related
Works with
Categories
Questions about Defender For Cloud Apps
What does Defender For Cloud Apps do?
Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection. Defender For Cloud Apps is an agent skill from vinayaklatthe/microsoft-security-skills. Guidance for Microsoft Defender for Cloud Apps (MDA) — the CASB for SaaS discovery, app governance, session controls, and threat detection.
When should I use Defender For Cloud Apps?
Defender For Cloud Apps fits situations like: iaaS / PaaS posture (use defender-for-cloud-hardening); endpoint EDR (use defender-for-endpoint); DLP (use purview-dlp-policy).
How do I install Defender For Cloud Apps in Claude Code?
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a claude-code`. Or copy the skill folder (skills/defender-for-cloud-apps in vinayaklatthe/microsoft-security-skills) into .claude/skills/defender-for-cloud-apps in your project. Claude Code loads it when a task matches its description.
How do I install Defender For Cloud Apps in Codex?
Run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a codex`. Or copy the skill folder (skills/defender-for-cloud-apps in vinayaklatthe/microsoft-security-skills) into .agents/skills/defender-for-cloud-apps in your project. Codex loads it when a task matches its description.
Can I use Defender For Cloud Apps in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vinayaklatthe/microsoft-security-skills --skill defender-for-cloud-apps -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/defender-for-cloud-apps, .gemini/skills/defender-for-cloud-apps, .github/skills/defender-for-cloud-apps and .opencode/skills/defender-for-cloud-apps in your project.
What does Defender For Cloud Apps need to run?
SKILL.md names no scripts, command-line tools or credentials: Defender For Cloud Apps is instructions for the agent only.
Does Defender For Cloud Apps access the network?
SKILL.md names 1 domain. As links in the text: learn.microsoft.com. This is read from the text; nothing was executed.
Is Defender For Cloud Apps safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Defender For Cloud Apps use?
Defender For Cloud Apps is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Defender For Cloud Apps use?
About 1.9k tokens (SKILL.md is roughly 7.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Defender For Cloud Apps?
Skills that share tags, products or a category with Defender For Cloud Apps: Entra Agent Id (microsoft/GitHub-Copilot-for-Azure, 255 stars), Detecting OAuth Token Theft (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Implementing API Threat Protection With Apigee (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Implementing Zero Trust For SaaS Applications (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Defender For Cloud Apps?
vinayaklatthe (a GitHub user) maintains it in vinayaklatthe/microsoft-security-skills, which has 175 GitHub stars. The repository holds 50 skills in this directory. The repository was last updated on June 18, 2026.
Source: vinayaklatthe/microsoft-security-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.