In Microsoft Defender for Cloud Apps (MCAS) , Cloud Discovery collects traffic logs to identify shadow IT usage and cloud app activiti es. To enrich this discovery data and map the usernames in traffic logs to actual Microsoft Entra ID (Azure AD) users, Defender for Cloud Apps must correlate the username with the user's User Principal Name (UPN) .
According to Microsoft Defender for Cloud Apps documentation, this correlation happens automatically when you connect Microsoft 365 (formerly Office 365) through a Microsoft 365 app connector .
The connector integrates MCAS with Microsoft 365, allowing it to:
* Normalize usernames from discovery logs to match UPNs.
* Provide enriched identity details and activities across Microsoft 365 apps.
* Enable cross-app investigation, alert correlation, and conditional access governance.
Other options explained:
* Conditional Access App Control - Used for real-time s ession control, not Cloud Discovery enrichment.
* Enable automatic redirection to Microsoft 365 Defender - Used for portal integration, not data enrichment.
* Azure app connector - Used to connect third-party or Azure-hosted applications, not for UPN enrichmen t.
# Therefore, to enrich Cloud Discovery data with UPN mapping, you must create a Microsoft 365 app connector .