Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
Elevate your security posture by taking control of your cloud applications
and services.
Today, data travels to many locations – across devices, apps, cloud services, and on-premises. It is
important to gain visibility and control of data in cloud applications, given the increasing number of
cybersecurity attacks and compliance requirements with key regulations.
Microsoft Cloud App Security is a Cloud Access Security Broker (CASB) that supports multiple
deployment modes. It gives you rich visibility, enables you to control how your data travels, and provides
sophisticated analytics to identify and combat cyberthreats – across all your cloud services.
Table of Contents
Licensing Overview ..........................................................................................................................................2
Microsoft 365 E5 ................................................................................................................................. 2
Microsoft 365 E5 Security ................................................................................................................... 2
Microsoft 365 E5 Compliance ............................................................................................................. 3
Enterprise Mobility & Security E5 (EMS E5) ......................................................................................... 3
Licensing plan: Microsoft Cloud App Security + Enterprise Mobility & Security E3 (EMS E3) ............. 3
Microsoft Cloud App Security (standalone license) ............................................................................. 3
Microsoft 365 Education A3 ................................................................................................................ 3
Microsoft 365 Education A5 ................................................................................................................ 3
Office 365 E5 ...................................................................................................................................... 4
Azure Active Directory Premium 1 / Azure AD Premium 2 ................................................................. 4
US Government Licensing ........................................................................................................................... 4
Cloud: GCC High .................................................................................................................................. 5
Microsoft Cloud App
Security
Licensing Datasheet
Microsoft Cloud App
Security
Licensing Datasheet
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
Cloud: DoD .......................................................................................................................................... 5
What is the price of Microsoft Cloud App Security? ........................................................................... 6
Who needs to be licensed for Microsoft Cloud App Security? ........................................................... 6
Which license do I need if I want O365 CAS only? ............................................................................. 7
Customers only need to purchase O365 E5 if the only cloud app security model they intend to
deploy is that of O365. ....................................................................................................................... 7
How do I acquire only the Discovery capabilities of Microsoft Cloud App Security? What are the
licensing plans? ................................................................................................................................... 7
What is the difference between Discovery capabilities in Azure AD P1 and Microsoft Cloud App
Security?.............................................................................................................................................. 7
What is the difference between Discovery capabilities in Office 365 Cloud App Security and
Microsoft Cloud App Security? ........................................................................................................... 7
When using Conditional Access App Control (reverse proxy) capabilities via Azure AD, do external
users need to be licensed? ................................................................................................................. 8
Licensing Purchase.............................................................................................................................. 8
Additional Information ....................................................................................................................................8
Find more information, please visit our website.................................................................................. 8
Licensing Overview
Microsoft Cloud App Security is a user-based subscription service. Each license is a per user, per
month license. Microsoft Cloud App Security can be licensed as a standalone product or as part of
several different licensing plans, listed below. When we refer to “the complete CASB offering”, we are
referring to an offering that includes all Cloud App Security capabilities, Office 365 Cloud App Security
and Cloud App Discovery.
Microsoft 365 E5
This is Microsoft’s most comprehensive Modern Workplace offering and includes the highest tier
offerings of Enterprise Mobility + Security, Office 365, and Windows. This licensing plan allows you to
enable the integration of Microsoft Cloud App Security and Microsoft Defender Advanced Threat
Protection to enable machine-based Discovery on and beyond the corporate network. For details, refer
to the technical documentation. For additional licensing information of M365 E5, please visit this page.
Microsoft 365 E5 Security
This licensing plan unifies our security value across Office 365, Windows and Enterprise Mobility &
Security (EMS). It includes Office 365 ATP Plan 2, Microsoft Cloud App Security, Azure Advanced Threat
Protection (Azure ATP), Azure AD Premium 2 (P2) and Microsoft Defender Advanced Threat Protection
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
(MDATP). Via this SKU customers can leverage the complete CASB offering. For more information, visit
this site.
Microsoft 365 E5 Compliance
This offer includes Information Protection & Governance, Insider Risk Management and eDiscovery &
Audit solutions. Via this SKU customers get the complete CASB offering. For more information, visit this
site.
Enterprise Mobility & Security E5 (EMS E5)
EMS E5 includes all CASB capabilities. EMS E5 furthermore adds automatic data classification and
labelling, as well as mobile device management and mobile app management to protect corporate
apps and data on any device and for any first and third-party app in our solution for data loss
prevention (DLP). For additional licensing information of M365 E5, please visit this page.
Licensing plan: Microsoft Cloud App Security + Enterprise Mobility & Security E3 (EMS
E3)
This combination of product licenses extends the capabilities of Microsoft Cloud App Security to
include Conditional Access App Control (Reverse proxy capabilities) for real-time session controls, and
automatic data classification and labeling. Conditional Access enables you to determine when to send
users via the Microsoft Cloud App Security reverse proxy and define what risk means in your
organization or use the built in “User Risk” feature. Automatic data classification and labeling helps
enable you to protect sensitive information in corporate applications for any first- and third-party
solutions, therefore assisting in data loss prevention.
This licensing plan provides customers with the complete range of capabilities of Microsoft’s CASB
offering. Additional details on EMS E3 licensing.
Microsoft Cloud App Security (standalone license)
This is a standalone license that includes all CASB functionality for first and third-party applications.
This per-user license includes an unlimited number of apps to be connected and protected for each
user.
Microsoft 365 Education A3
The education edition of Office 365 A3 includes Office 365 Cloud App Security. This licensing plan is
available to educational institutions and includes Microsoft Cloud App Security. Additional details can
be found here.
Microsoft 365 Education A5
This licensing plan is available to educational institutions and includes Microsoft Cloud App Security.
Additional details can be found here.
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
Office 365 E5
This licensing plan includes Office 365 Cloud App Security, which is a subset of Microsoft Cloud App
Security capabilities. The subset includes Discovery and Risk assessment capabilities, as well as all
other Microsoft Cloud App Security functionality, but limited to the use of Office 365, i.e. no 3rdparty
applications can be connected and managed with this license. Please see additional documentation
here for more details.
Azure Active Directory Premium 1 / Azure AD Premium 2
AADP P1/P2 includes the Microsoft Cloud App Security Discovery and Risk Assessment capabilities
only. AADP P1/P2 does not include the reverse proxy/session control aspects of Conditional
Access. In order to utilize the interoperability of AAD Premium Conditional Access and
MCAS reverse/session proxy, both MCAS and AADP P1 licenses are required.
For additional Cloud App Security feature details, please see documentation found here. For
information on AAD licensing, refer to this site.
US Government Licensing
The following is a description of services available for our US Government customers. Broadly,
Microsoft provides three licensing plans, Government Community Cloud (GCC), Government
Community Cloud – High (GCC High), and Department of Defense (DoD). Each of these
environments has specific compliance capabilities. You can learn more about US Government EMS
service descriptions here and the compliance attributes for Microsoft Cloud App Security here.
Cloud: GCC
These licensing plans are offered in the Azure Commercial environment and are covered by Azure
Commercial’s FedRAMP High Authorization to Operate (ATO), but may not meet other GCC
compliance attributes, such as CJIS background screening, (IRS 1075, CJIS) and access to customer
content being restricted to US government screened personnel. A list of compliance offerings for
Microsoft products and services can be found on the Microsoft Trust Center. For information on
where Microsoft stores customer data at rest for Microsoft Cloud App Security, please review the
Online Services Terms and the product documentation.
Please see the different licensing plans below available for the GCC Cloud. There will be a ‘-‘ where
the product is not expected to be part of that licensing plan.
Product
MCAS
Standalone
O365
G5 GCC
AAD
P1
GCC
AAD
P2
GCC
EMS
E3
GCC
M365
G3
GCC
M365
G5 GCC
MCAS
$0 add
on
AATP
$0 add
on
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
Microsoft
Cloud App
Security
No
-
-
-
-
No *
reference
$0 add-on
-
No
Yes
-
Office O365
App Security
-
No
-
-
-
-
-
-
-
-
Azure AD
Cloud App
Security
Discovery
-
-
No
No
No
-
No
-
-
-
Azure ATP
No
-
-
-
-
No*
reference
$0 add-on
-
No
-
Yes
Does not exist: M365 Security GCC, M365 Compliance GCC
*The EMS E5 Licenses in GCC does not include Microsoft Cloud App Security or Azure Advanced
Threat Protection. In order for the GCC customers to gain access to these products, customers have
the option to utilize a commercial instance of this service that meets commercial cloud compliance
standards with the purchase of an EMS E5 GCC SKU and the $0 add-on as referenced above. Further
details about Microsoft Cloud App Security as an add-on to EMS can be found here.
Cloud: GCC High
The Microsoft Cloud App Security offering for GCC High is built on Microsoft Azure Government
cloud and designed to inter-operate with the Office 365 GCC High environment.
Please see the different licensing plans below available for the GCC High Cloud. There will be a ‘-‘
where the product is not expected to be part of that licensing plan.
Product
MCAS
Standalone
O365
E5 GCC
High
AAD
P1
GCC
High
AAD
P2
GCC
High
EMS
E3
GCC
High
EMS E5
GCC High
M365
G3
GCC
High
M365
G5
GCC
High
M365
E5
Security
GCC
High
M365 E5
Compliance
GCC High
Microsoft
Cloud App
Security
Yes
-
-
-
-
Yes
-
Yes
Yes
Yes
Office O365
App Security
-
Yes
-
-
-
-
-
-
-
-
Azure AD
Cloud App
Security
Discovery
-
-
Yes
Yes
Yes
-
Yes
-
-
-
Azure ATP
Yes
-
-
-
-
Yes
-
Yes
Yes
-
Cloud: DoD
As of July 2020, there is no availability for Microsoft Cloud App Security in DoD environments. Refer to
the Microsoft service roadmap for an update on any availability for this cloud service.
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
Frequently Asked Questions
What is the price of Microsoft Cloud App Security?
The price for commercial licenses for Microsoft Cloud App Security varies by program, region and
agreement type. In the Direct channel, there are ERP standalone list prices. Please see details on the
pricing configurations here.
Additionally, if customers want to use the Conditional Access App Control feature of Microsoft Cloud
App Security, they must also have at least an Azure Active Directory Premium P1 (AAD P1) license for
all users they intend to enable for this feature.
Licensing plans available to US government customers that include Microsoft Cloud App Security are
described in the licensing tables below. Additional details can be found in our licensing and pricing
descriptions:
Office 365 US Government
Microsoft 365 Government
Enterprise Mobility + Security for US Government
Who needs to be licensed for Microsoft Cloud App Security?
Each user must be licensed for Microsoft Cloud App Security to use or benefit from it. For customers
who license a subset of users, services enforced at the tenant level are not licensed for the other users.
They are not entitled to use or benefit from the service, regardless of whether the service is technically
accessible. To be compliant, customers must license any user that they intend to benefit from the
service.
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
Which license do I need if I want O365 CAS only?
Customers only need to purchase O365 E5 if the only cloud app security model they intend to deploy
is that of O365.
How do I acquire only the Discovery capabilities of Microsoft Cloud App Security?
What are the licensing plans?
The Microsoft Cloud App Security Discovery feature is included in various licensing plans. If your
customer has any of the below licenses, they will be able to access the Discovery capabilities within
Microsoft Cloud App Security:
- Microsoft Cloud App Security
- Azure Active Directory P1
- Enterprise Mobility + Security E3, which includes AAD P1 license
- Office 365 E5 – discovery for Office products only
All prices are per user/ per month. There is no standalone SKU available for “Discovery-only”
capabilities. For a detailed overview of all discovery capabilities please refer to the “Discovery” section
on this site. Please contact your Microsoft reseller or representative for a price quote specific to you.
Note that Microsoft does not determine pricing or payment terms for licenses acquired through
resellers.
What is the difference between Discovery capabilities in Azure AD P1 and Microsoft
Cloud App Security?
All Discovery capabilities are equally available in Azure AD Premium P1 and Microsoft Cloud App
Security except for anomaly detection alerts. For a detailed overview of all discovery capabilities please
refer to the “Cloud Discovery” list of features in the context of this datasheet.
What is the difference between Discovery capabilities in Office 365 Cloud App Security
and Microsoft Cloud App Security?
For a detailed overview of all discovery capabilities please refer to the “Cloud Discovery” list of features
in the context of this datasheet.
Published in July 2020. This document is provided “as-is”. Information and views expressed in this document, including URL and internet web site references, may change
without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product.
When using Conditional Access App Control (reverse proxy) capabilities via Azure AD,
do external users need to be licensed?
When customers configure Conditional Access App Control to implement real-time controls and have
guest users in their network via the free guest licenses in Azure AD, they do not require Microsoft Cloud
App Security licenses for the external users that will be leveraging the reverse proxy infrastructure.
Licensing Purchase
Microsoft Cloud App Security is available in Enterprise Agreement (EA), Open Program, Cloud Solution
Provider (CSP), and Direct channels.. Each user must be licensed for Microsoft Cloud App Security to
use or benefit from it. For customers who license a subset of users, services enforced at the tenant level
are not licensed for the other users. They are not entitled to use or benefit from the service, regardless
of whether the service is technically accessible.
Please contact your Microsoft reseller or representative for a price quote specific to you. Note that
Microsoft does not determine pricing or payment terms for licenses acquired through resellers.
Additional Information
• Learn how to get started with Microsoft Cloud App Security with our detailed technical
documentation.
• If you don’t have Microsoft Cloud App Security, start a free trial today.
• Stay up to date with our latest feature updates and products news and subscribe to our blog.
• To engage with peers and our product team for suggestions, questions, or comments, please
visit us on our Tech Community page.
Find more information, please visit our website.