Salesforce connector enhancements (Preview)
Analysis / inference: Microsoft Defender for Cloud Apps introduces preview features for Salesforce including Real-Time Event Monitoring ingestion and granular OAuth app governance.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Cloud Apps release notes · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
The Salesforce connector now supports near real-time telemetry ingestion from Salesforce Event Monitoring and introduces OAuth app governance views for Connected Apps and External Client Apps (ECAs).
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisEnhanced Salesforce connector capabilities provide near real-time ingestion of Real-Time Event Monitoring data and deep OAuth app governance to combat advanced token and session abuse.
SOC analysts gain richer investigation context for OAuth abuse, session hijacking, and anomalous API activity while security administrators must enable Salesforce settings to leverage the preview telemetry.
Section 03 · Recommended actions
- Enable Real-Time Event Monitoring in the Salesforce console
- Review newly surfaced Highly privileged and Unused app insights in the Application and Identity inventories
- Audit permissions granted to Salesforce Connected Apps and External Client Apps using the App governance page
- Verify that Salesforce Real-Time Event Monitoring is enabled in your Salesforce console to reduce ingestion latency
- Review the Application inventory OAuth apps tab for newly surfaced Highly privileged and Unused app insights
- Inspect permissions for Salesforce Connected Apps and External Client Apps (ECAs) on the App governance page