Stats
Actions
Tags
From asi
Implements zero trust access controls for SaaS apps using CASB, SSPM, conditional access policies, OAuth governance, and session controls to enforce MFA, device compliance, and DLP.
How this skill is triggered — by the user, by Claude, or both
Slash command
/asi:implementing-zero-trust-for-saas-applicationsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- When securing access to SaaS applications (Microsoft 365, Google Workspace, Salesforce, Slack)
Do not use as a replacement for SaaS-native security controls (configure those first), for applications with no SAML/OIDC support, or when SaaS vendor does not support API integration for CASB/SSPM.
Centralize authentication for all SaaS applications through a single IdP.
# Configure SAML SSO for Salesforce via Entra ID
Connect-MgGraph -Scopes "Application.ReadWrite.All"
# Create enterprise application for Salesforce
$app = New-MgServicePrincipal -AppId "SALESFORCE_APP_ID" -DisplayName "Salesforce"
# Configure SAML SSO settings
$samlSettings = @{
preferredSingleSignOnMode = "saml"
samlSingleSignOnSettings = @{
relayState = ""
}
}
Update-MgServicePrincipal -ServicePrincipalId $app.Id -BodyParameter $samlSettings
# Assign user groups to the application
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id -BodyParameter @{
principalId = "SALES_GROUP_ID"
resourceId = $app.Id
appRoleId = "DEFAULT_ROLE_ID"
}
Enforce identity and device requirements before granting SaaS access.
# Block access from non-compliant devices to sensitive SaaS apps
$policy = @{
displayName = "ZT - Require Compliant Device for SaaS"
state = "enabled"
conditions = @{
applications = @{
includeApplications = @("SALESFORCE_APP_ID", "M365_APP_ID", "SLACK_APP_ID")
}
users = @{
includeUsers = @("All")
excludeGroups = @("BREAK_GLASS_GROUP")
}
clientAppTypes = @("browser", "mobileAppsAndDesktopClients")
}
grantControls = @{
operator = "AND"
builtInControls = @("mfa", "compliantDevice")
}
sessionControls = @{
cloudAppSecurity = @{
isEnabled = $true
cloudAppSecurityType = "mcasConfigured"
}
signInFrequency = @{
value = 8
type = "hours"
isEnabled = $true
}
}
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $policy
# Block downloads on unmanaged devices
$downloadPolicy = @{
displayName = "ZT - Block Downloads on Unmanaged Devices"
state = "enabled"
conditions = @{
applications = @{ includeApplications = @("SHAREPOINT_APP_ID") }
users = @{ includeUsers = @("All") }
devices = @{
deviceFilter = @{
mode = "include"
rule = "device.isCompliant -ne True -or device.trustType -ne 'ServerAD'"
}
}
}
sessionControls = @{
cloudAppSecurity = @{
isEnabled = $true
cloudAppSecurityType = "mcasConfigured"
}
}
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $downloadPolicy
Configure Microsoft Defender for Cloud Apps to discover and control SaaS usage.
# Query discovered cloud apps via Defender for Cloud Apps API
curl -X GET "https://api.cloudappsecurity.com/api/v1/discovery/" \
-H "Authorization: Token ${MDCA_API_TOKEN}" \
-H "Content-Type: application/json"
# Get list of unsanctioned apps
curl -X GET "https://api.cloudappsecurity.com/api/v1/discovery/discovered_apps/" \
-H "Authorization: Token ${MDCA_API_TOKEN}" \
-d '{
"filters": {
"appTag": {"eq": "unsanctioned"},
"traffic": {"gte": 1000}
},
"sortField": "traffic",
"sortDirection": "desc"
}'
# Create session policy for DLP enforcement
curl -X POST "https://api.cloudappsecurity.com/api/v1/policies/" \
-H "Authorization: Token ${MDCA_API_TOKEN}" \
-d '{
"name": "Block PII Upload to SaaS",
"policyType": "SESSION",
"severity": "HIGH",
"enabled": true,
"sessionPolicyType": "CONTROL_UPLOAD",
"filters": {
"fileType": {"eq": ["DOCUMENT", "SPREADSHEET"]},
"contentInspection": {
"dataType": ["CREDIT_CARD", "SSN", "PASSPORT"]
}
},
"actions": {
"block": true,
"notify": {
"emailRecipients": ["[email protected]"]
}
}
}'
Review and restrict OAuth application permissions to prevent excessive consent.
# Query OAuth apps with high-privilege permissions
$oauthApps = Invoke-MgGraphRequest -Method GET `
"https://graph.microsoft.com/v1.0/servicePrincipals?\$filter=tags/any(t:t eq 'WindowsAzureActiveDirectoryIntegratedApp')&\$select=displayName,appId,oauth2PermissionScopes"
# Review consent grants
$grants = Get-MgOauth2PermissionGrant -All
$highRisk = $grants | Where-Object {
$_.Scope -match "Mail.ReadWrite|Files.ReadWrite.All|Directory.ReadWrite.All"
}
Write-Host "High-risk OAuth grants: $($highRisk.Count)"
$highRisk | ForEach-Object {
$sp = Get-MgServicePrincipal -ServicePrincipalId $_.ClientId
Write-Host " App: $($sp.DisplayName) | Scope: $($_.Scope) | Type: $($_.ConsentType)"
}
# Configure app consent policy to require admin approval
$consentPolicy = @{
displayName = "Require Admin Approval for High-Risk Permissions"
conditions = @{
clientApplications = @{ includeAllClientApplications = $true }
permissions = @{
permissionClassification = "high"
permissions = @(
@{ permissionValue = "Mail.ReadWrite"; permissionType = "delegated" }
@{ permissionValue = "Files.ReadWrite.All"; permissionType = "delegated" }
)
}
}
}
Audit and remediate SaaS security configuration drift.
# Query SaaS security posture via CASB API
curl -X GET "https://api.cloudappsecurity.com/api/v1/security_config/" \
-H "Authorization: Token ${MDCA_API_TOKEN}" \
-d '{"app": "Microsoft 365"}'
# Common SSPM checks:
# - MFA enforcement for all admin accounts
# - External sharing restrictions in SharePoint/OneDrive
# - Email forwarding rules to external domains blocked
# - Idle session timeout configured (< 8 hours)
# - Legacy authentication protocols disabled
# - Admin consent workflow enabled
# - Conditional access policies active
# - Audit logging enabled for all services
| Term | Definition |
|---|---|
| CASB | Cloud Access Security Broker - intermediary enforcing security policies between users and SaaS applications |
| SSPM | SaaS Security Posture Management - continuous monitoring of SaaS application security configurations |
| OAuth Governance | Review and control of third-party application permissions granted through OAuth consent flows |
| Session Controls | Real-time access restrictions (block downloads, DLP inspection, watermarking) applied during active SaaS sessions |
| Shadow IT | Unauthorized SaaS applications used by employees without IT approval or security review |
| Conditional Access | Policy engine evaluating identity, device, location, and risk signals before granting SaaS access |
Context: A professional services firm with 1,000 users uses Microsoft 365, Salesforce, Slack, and 20+ other SaaS apps. Several data breaches in the industry drive a zero trust initiative for all SaaS access.
Approach:
Pitfalls: Conditional access policies need break-glass exclusions. Some legacy SaaS apps may not support modern authentication. Session controls require proxy-based CASB which can impact performance. OAuth app revocation may break integrations; coordinate with app owners first.
Zero Trust SaaS Security Report
==================================================
Organization: ProServices Corp
Report Date: 2026-02-23
SAAS INVENTORY:
Sanctioned Apps: 25
Unsanctioned (blocked): 127
Shadow IT Users: 342 (discovered in last 30 days)
CONDITIONAL ACCESS:
Policies active: 8
Sign-ins evaluated: 456,789
Blocked by policy: 2,345 (0.5%)
MFA enforced: 100% of sign-ins
DEVICE COMPLIANCE:
Compliant device required: All 25 sanctioned apps
Sign-ins from compliant: 448,123 (98.1%)
Sign-ins blocked (non-compliant): 8,666
CASB / DLP:
DLP violations detected: 89
Files blocked from upload: 34
Downloads blocked (unmanaged): 1,234
OAUTH GOVERNANCE:
Total OAuth apps: 312
High-risk permissions: 12 (reviewed)
Revoked consents: 45
Pending admin approval: 8
SSPM FINDINGS:
Critical misconfigurations: 3
High: 7
Medium: 15
Remediated this month: 18
npx claudepluginhub plurigrid/asi --plugin asiImplements zero trust access controls for SaaS apps using CASB, SSPM, conditional access policies, OAuth governance, and session controls with PowerShell examples for Entra ID.
Implements zero trust access controls for SaaS applications using CASB, SSPM, conditional access, OAuth governance, and session controls to enforce identity verification and data protection.
Implements zero-trust access control for SaaS apps using CASB, SSPM, conditional access policies, OAuth governance, and session controls. Enforces MFA, device compliance, and DLP on M365, Salesforce, Slack.