How to connect Microsoft Defender with PowerBi

Hi @Rugved Rajendra Vaidya ,

Thanks for the details!

From your description, You want to build a custom Power BI dashboard that shows Cloud Discovery data from Microsoft Defender for Cloud Apps (for apps like Google Drive—personal & enterprise—Dropbox, WhatsApp), including a simple user view and upload/traffic activity.

The articles and videos you saw might be a bit tricky because what you found about “Defender + Power BI” actually describe Microsoft Defender for Cloud (Azure) via Azure Resource Graph. That’s a different product and does not contain Cloud Discovery traffic. That’s why those steps might not the data you need.

Is it possible?

• Yes.

Direct connector from Cloud Discovery to Power BI?

• No (there isn’t a one‑click/ready-made connector).

The working approach might be using the Cloud App Discovery APIs to pull the data, then load it into Power BI:

• Turn on/verify Cloud Discovery so data exists.
• Read the discovery results (apps, users, traffic summaries) using the Microsoft Graph (Cloud App Discovery) endpoints (currently in preview).
• (Optional) Use the MDCA REST API if you need to manage log uploads or discovery streams.

Here are a few steps you could try:

1. Make sure Cloud Discovery is actually collecting data

If you haven’t already, enable Cloud Discovery (for example, via Defender for Endpoint or a log collector).

Reference:

• Cloud app discovery overview
• Create snapshot cloud discovery reports

2. Choose the simplest integration path for you

Fastest: Connect Power BI to the Microsoft Graph Cloud App Discovery endpoints (read-only) to fetch:

• the list of discovery streams (data sources),
• apps used in a period (e.g., last 30/90 days), and
• who used a specific app (users/devices), which you can display in your user panel.

Most reliable for ongoing refresh: Run a tiny script or Logic App to pull the same Graph data on a schedule and save it (CSV/JSON) to storage (e.g., Azure Blob or SQL). Then point Power BI to that store. This keeps refresh simple and less error‑prone.

Reference:

• Work with discovered apps via Graph API (Preview)
• Use the Microsoft Defender for Cloud apps API in Microsoft Graph (preview)

Why Graph?

It exposes the aggregated Cloud Discovery results you need (apps, usage summaries, and users). The separate MDCA REST docs are mainly for admin tasks like uploading logs or listing continuous reports.

References: Cloud discovery API

3. Build the visuals in Power BI (simple recipe)

Create three simple tables from the API results:

• Apps (name, category, risk, traffic/bytes/transactions),
• Users (user ↔ app usage),
• Time/Period (P7D/P30D/P90D).

Then add:

• Cards: total upload/traffic, # of apps, # of users.
• Bar/Line: upload/traffic by app over time (spot spikes).
• User panel: a matrix (Users × Apps) with drill-through to details. (This matches what leadership typically wants to see at a glance.)

4. A quick but important clarification

If you see guidance that says “connect Defender to Power BI,” it’s almost always about Defender for Cloud (Azure), not Defender for Cloud Apps (Cloud Discovery), that’s why it doesn’t show Google Drive/Dropbox/WhatsApp traffic.

Reference: Add Defender for Cloud data to Power BI

Summary

There’s no direct connector, but you can confidently build your Power BI dashboard by turning on Cloud Discovery and then using the Cloud App Discovery APIs (via Microsoft Graph) to bring in app + user + traffic data.

I hope this helps! That's my approach and please let me know how it goes!