[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DAYB64V39CWGC2BEH1PZP3":3,"skill-same:01M7DAYB64V39CWGC2BEH1PZP3":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M7DAYB64V39CWGC2BEH1PZP3","implementing-zero-trust-for-saas-applications",null,"Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB\u002FSSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity verification and device compliance. Use when adding MFA\u002Fdevice-compliance conditional access, discovering shadow IT, governing OAuth consent grants, or applying session controls to sensitive SaaS data.","SaiVatsal\u002FSkills-I-Use","SaiVatsal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F242597752?v=4","01M7D5YM1T4VXW9203M0GFAHZ1","SaiVatsalPolimera","01M7D5YM2D61ST39XVR2V7B7ZJ",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fimplementing-zero-trust-for-saas-applications\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fimplementing-zero-trust-for-saas-applications\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: implementing-zero-trust-for-saas-applications\ndescription: Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB\u002FSSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity verification and device compliance. Use when adding MFA\u002Fdevice-compliance conditional access, discovering shadow IT, governing OAuth consent grants, or applying session controls to sensitive SaaS data.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- saas-security\n- casb\n- sspm\n- conditional-access\n- oauth-governance\n- session-controls\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1078.004\n- T1530\n---\n\n# Implementing Zero Trust for SaaS Applications\n\n## When to Use\n\n- When securing access to SaaS applications (Microsoft 365, Google Workspace, Salesforce, Slack)\n- When implementing conditional access policies requiring MFA and device compliance for SaaS\n- When deploying CASB for shadow IT discovery and unsanctioned app blocking\n- When enforcing session-level controls (DLP, download restrictions) for sensitive SaaS data\n- When governing OAuth application permissions and detecting excessive consent grants\n\n**Do not use** as a replacement for SaaS-native security controls (configure those first), for applications with no SAML\u002FOIDC support, or when SaaS vendor does not support API integration for CASB\u002FSSPM.\n\n## Prerequisites\n\n- Identity provider with conditional access: Microsoft Entra ID P1\u002FP2, Okta\n- CASB solution: Microsoft Defender for Cloud Apps, Netskope, or Zscaler CASB\n- SaaS applications configured with SSO via SAML 2.0 or OIDC\n- MDM enrollment for device compliance signals (Intune, Jamf)\n- DLP policies defined for sensitive data categories\n\n## Workflow\n\n### Step 1: Federate SaaS Authentication Through Identity Provider\n\nCentralize authentication for all SaaS applications through a single IdP.\n\n```powershell\n# Configure SAML SSO for Salesforce via Entra ID\nConnect-MgGraph -Scopes \"Application.ReadWrite.All\"\n\n# Create enterprise application for Salesforce\n$app = New-MgServicePrincipal -AppId \"SALESFORCE_APP_ID\" -DisplayName \"Salesforce\"\n\n# Configure SAML SSO settings\n$samlSettings = @{\n    preferredSingleSignOnMode = \"saml\"\n    samlSingleSignOnSettings = @{\n        relayState = \"\"\n    }\n}\nUpdate-MgServicePrincipal -ServicePrincipalId $app.Id -BodyParameter $samlSettings\n\n# Assign user groups to the application\nNew-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id -BodyParameter @{\n    principalId = \"SALES_GROUP_ID\"\n    resourceId = $app.Id\n    appRoleId = \"DEFAULT_ROLE_ID\"\n}\n```\n\n### Step 2: Create Conditional Access Policies for SaaS Applications\n\nEnforce identity and device requirements before granting SaaS access.\n\n```powershell\n# Block access from non-compliant devices to sensitive SaaS apps\n$policy = @{\n    displayName = \"ZT - Require Compliant Device for SaaS\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"SALESFORCE_APP_ID\", \"M365_APP_ID\", \"SLACK_APP_ID\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BREAK_GLASS_GROUP\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        cloudAppSecurity = @{\n            isEnabled = $true\n            cloudAppSecurityType = \"mcasConfigured\"\n        }\n        signInFrequency = @{\n            value = 8\n            type = \"hours\"\n            isEnabled = $true\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $policy\n\n# Block downloads on unmanaged devices\n$downloadPolicy = @{\n    displayName = \"ZT - Block Downloads on Unmanaged Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"SHAREPOINT_APP_ID\") }\n        users = @{ includeUsers = @(\"All\") }\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True -or device.trustType -ne 'ServerAD'\"\n            }\n        }\n    }\n    sessionControls = @{\n        cloudAppSecurity = @{\n            isEnabled = $true\n            cloudAppSecurityType = \"mcasConfigured\"\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $downloadPolicy\n```\n\n### Step 3: Deploy CASB for Shadow IT Discovery and App Governance\n\nConfigure Microsoft Defender for Cloud Apps to discover and control SaaS usage.\n\n```bash\n# Query discovered cloud apps via Defender for Cloud Apps API\ncurl -X GET \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fdiscovery\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Get list of unsanctioned apps\ncurl -X GET \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fdiscovery\u002Fdiscovered_apps\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -d '{\n    \"filters\": {\n      \"appTag\": {\"eq\": \"unsanctioned\"},\n      \"traffic\": {\"gte\": 1000}\n    },\n    \"sortField\": \"traffic\",\n    \"sortDirection\": \"desc\"\n  }'\n\n# Create session policy for DLP enforcement\ncurl -X POST \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fpolicies\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -d '{\n    \"name\": \"Block PII Upload to SaaS\",\n    \"policyType\": \"SESSION\",\n    \"severity\": \"HIGH\",\n    \"enabled\": true,\n    \"sessionPolicyType\": \"CONTROL_UPLOAD\",\n    \"filters\": {\n      \"fileType\": {\"eq\": [\"DOCUMENT\", \"SPREADSHEET\"]},\n      \"contentInspection\": {\n        \"dataType\": [\"CREDIT_CARD\", \"SSN\", \"PASSPORT\"]\n      }\n    },\n    \"actions\": {\n      \"block\": true,\n      \"notify\": {\n        \"emailRecipients\": [\"security-team@company.com\"]\n      }\n    }\n  }'\n```\n\n### Step 4: Configure OAuth App Governance\n\nReview and restrict OAuth application permissions to prevent excessive consent.\n\n```powershell\n# Query OAuth apps with high-privilege permissions\n$oauthApps = Invoke-MgGraphRequest -Method GET `\n  \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FservicePrincipals?\\$filter=tags\u002Fany(t:t eq 'WindowsAzureActiveDirectoryIntegratedApp')&\\$select=displayName,appId,oauth2PermissionScopes\"\n\n# Review consent grants\n$grants = Get-MgOauth2PermissionGrant -All\n$highRisk = $grants | Where-Object {\n    $_.Scope -match \"Mail.ReadWrite|Files.ReadWrite.All|Directory.ReadWrite.All\"\n}\n\nWrite-Host \"High-risk OAuth grants: $($highRisk.Count)\"\n$highRisk | ForEach-Object {\n    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.ClientId\n    Write-Host \"  App: $($sp.DisplayName) | Scope: $($_.Scope) | Type: $($_.ConsentType)\"\n}\n\n# Configure app consent policy to require admin approval\n$consentPolicy = @{\n    displayName = \"Require Admin Approval for High-Risk Permissions\"\n    conditions = @{\n        clientApplications = @{ includeAllClientApplications = $true }\n        permissions = @{\n            permissionClassification = \"high\"\n            permissions = @(\n                @{ permissionValue = \"Mail.ReadWrite\"; permissionType = \"delegated\" }\n                @{ permissionValue = \"Files.ReadWrite.All\"; permissionType = \"delegated\" }\n            )\n        }\n    }\n}\n```\n\n### Step 5: Implement SaaS Security Posture Management (SSPM)\n\nAudit and remediate SaaS security configuration drift.\n\n```bash\n# Query SaaS security posture via CASB API\ncurl -X GET \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fsecurity_config\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -d '{\"app\": \"Microsoft 365\"}'\n\n# Common SSPM checks:\n# - MFA enforcement for all admin accounts\n# - External sharing restrictions in SharePoint\u002FOneDrive\n# - Email forwarding rules to external domains blocked\n# - Idle session timeout configured (\u003C 8 hours)\n# - Legacy authentication protocols disabled\n# - Admin consent workflow enabled\n# - Conditional access policies active\n# - Audit logging enabled for all services\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CASB | Cloud Access Security Broker - intermediary enforcing security policies between users and SaaS applications |\n| SSPM | SaaS Security Posture Management - continuous monitoring of SaaS application security configurations |\n| OAuth Governance | Review and control of third-party application permissions granted through OAuth consent flows |\n| Session Controls | Real-time access restrictions (block downloads, DLP inspection, watermarking) applied during active SaaS sessions |\n| Shadow IT | Unauthorized SaaS applications used by employees without IT approval or security review |\n| Conditional Access | Policy engine evaluating identity, device, location, and risk signals before granting SaaS access |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud Apps**: CASB providing shadow IT discovery, session controls, DLP, and SSPM\n- **Microsoft Entra ID Conditional Access**: Policy engine for identity-based access control to SaaS applications\n- **Netskope CASB**: Cloud-native CASB with inline and API-based SaaS security controls\n- **Okta Identity Governance**: OAuth app governance and access certification for SaaS applications\n- **SSPM Tools**: AppOmni, Adaptive Shield, Valence Security for SaaS configuration monitoring\n\n## Common Scenarios\n\n### Scenario: Securing Microsoft 365 and Salesforce for 1,000-User Organization\n\n**Context**: A professional services firm with 1,000 users uses Microsoft 365, Salesforce, Slack, and 20+ other SaaS apps. Several data breaches in the industry drive a zero trust initiative for all SaaS access.\n\n**Approach**:\n1. Federate all SaaS authentication through Entra ID with SAML SSO\n2. Create conditional access policies requiring MFA + compliant device for all SaaS apps\n3. Deploy Defender for Cloud Apps for shadow IT discovery (identify 150+ unauthorized apps)\n4. Mark unauthorized apps as unsanctioned and block via SWG\u002Fproxy\n5. Configure session controls: block downloads on unmanaged devices, DLP for file uploads\n6. Review OAuth app permissions: revoke 45 high-risk consent grants, enable admin approval workflow\n7. Enable SSPM monitoring for Microsoft 365 and Salesforce configurations\n8. Set up weekly automated posture reports for security leadership\n\n**Pitfalls**: Conditional access policies need break-glass exclusions. Some legacy SaaS apps may not support modern authentication. Session controls require proxy-based CASB which can impact performance. OAuth app revocation may break integrations; coordinate with app owners first.\n\n## Output Format\n\n```\nZero Trust SaaS Security Report\n==================================================\nOrganization: ProServices Corp\nReport Date: 2026-02-23\n\nSAAS INVENTORY:\n  Sanctioned Apps: 25\n  Unsanctioned (blocked): 127\n  Shadow IT Users: 342 (discovered in last 30 days)\n\nCONDITIONAL ACCESS:\n  Policies active: 8\n  Sign-ins evaluated: 456,789\n  Blocked by policy: 2,345 (0.5%)\n  MFA enforced: 100% of sign-ins\n\nDEVICE COMPLIANCE:\n  Compliant device required: All 25 sanctioned apps\n  Sign-ins from compliant: 448,123 (98.1%)\n  Sign-ins blocked (non-compliant): 8,666\n\nCASB \u002F DLP:\n  DLP violations detected: 89\n  Files blocked from upload: 34\n  Downloads blocked (unmanaged): 1,234\n\nOAUTH GOVERNANCE:\n  Total OAuth apps: 312\n  High-risk permissions: 12 (reviewed)\n  Revoked consents: 45\n  Pending admin approval: 8\n\nSSPM FINDINGS:\n  Critical misconfigurations: 3\n  High: 7\n  Medium: 15\n  Remediated this month: 18\n```\n","# Implementing Zero Trust for SaaS Applications\n\n## When to Use\n\n- When securing access to SaaS applications (Microsoft 365, Google Workspace, Salesforce, Slack)\n- When implementing conditional access policies requiring MFA and device compliance for SaaS\n- When deploying CASB for shadow IT discovery and unsanctioned app blocking\n- When enforcing session-level controls (DLP, download restrictions) for sensitive SaaS data\n- When governing OAuth application permissions and detecting excessive consent grants\n\n**Do not use** as a replacement for SaaS-native security controls (configure those first), for applications with no SAML\u002FOIDC support, or when SaaS vendor does not support API integration for CASB\u002FSSPM.\n\n## Prerequisites\n\n- Identity provider with conditional access: Microsoft Entra ID P1\u002FP2, Okta\n- CASB solution: Microsoft Defender for Cloud Apps, Netskope, or Zscaler CASB\n- SaaS applications configured with SSO via SAML 2.0 or OIDC\n- MDM enrollment for device compliance signals (Intune, Jamf)\n- DLP policies defined for sensitive data categories\n\n## Workflow\n\n### Step 1: Federate SaaS Authentication Through Identity Provider\n\nCentralize authentication for all SaaS applications through a single IdP.\n\n```powershell\n# Configure SAML SSO for Salesforce via Entra ID\nConnect-MgGraph -Scopes \"Application.ReadWrite.All\"\n\n# Create enterprise application for Salesforce\n$app = New-MgServicePrincipal -AppId \"SALESFORCE_APP_ID\" -DisplayName \"Salesforce\"\n\n# Configure SAML SSO settings\n$samlSettings = @{\n    preferredSingleSignOnMode = \"saml\"\n    samlSingleSignOnSettings = @{\n        relayState = \"\"\n    }\n}\nUpdate-MgServicePrincipal -ServicePrincipalId $app.Id -BodyParameter $samlSettings\n\n# Assign user groups to the application\nNew-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id -BodyParameter @{\n    principalId = \"SALES_GROUP_ID\"\n    resourceId = $app.Id\n    appRoleId = \"DEFAULT_ROLE_ID\"\n}\n```\n\n### Step 2: Create Conditional Access Policies for SaaS Applications\n\nEnforce identity and device requirements before granting SaaS access.\n\n```powershell\n# Block access from non-compliant devices to sensitive SaaS apps\n$policy = @{\n    displayName = \"ZT - Require Compliant Device for SaaS\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{\n            includeApplications = @(\"SALESFORCE_APP_ID\", \"M365_APP_ID\", \"SLACK_APP_ID\")\n        }\n        users = @{\n            includeUsers = @(\"All\")\n            excludeGroups = @(\"BREAK_GLASS_GROUP\")\n        }\n        clientAppTypes = @(\"browser\", \"mobileAppsAndDesktopClients\")\n    }\n    grantControls = @{\n        operator = \"AND\"\n        builtInControls = @(\"mfa\", \"compliantDevice\")\n    }\n    sessionControls = @{\n        cloudAppSecurity = @{\n            isEnabled = $true\n            cloudAppSecurityType = \"mcasConfigured\"\n        }\n        signInFrequency = @{\n            value = 8\n            type = \"hours\"\n            isEnabled = $true\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $policy\n\n# Block downloads on unmanaged devices\n$downloadPolicy = @{\n    displayName = \"ZT - Block Downloads on Unmanaged Devices\"\n    state = \"enabled\"\n    conditions = @{\n        applications = @{ includeApplications = @(\"SHAREPOINT_APP_ID\") }\n        users = @{ includeUsers = @(\"All\") }\n        devices = @{\n            deviceFilter = @{\n                mode = \"include\"\n                rule = \"device.isCompliant -ne True -or device.trustType -ne 'ServerAD'\"\n            }\n        }\n    }\n    sessionControls = @{\n        cloudAppSecurity = @{\n            isEnabled = $true\n            cloudAppSecurityType = \"mcasConfigured\"\n        }\n    }\n}\nNew-MgIdentityConditionalAccessPolicy -BodyParameter $downloadPolicy\n```\n\n### Step 3: Deploy CASB for Shadow IT Discovery and App Governance\n\nConfigure Microsoft Defender for Cloud Apps to discover and control SaaS usage.\n\n```bash\n# Query discovered cloud apps via Defender for Cloud Apps API\ncurl -X GET \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fdiscovery\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -H \"Content-Type: application\u002Fjson\"\n\n# Get list of unsanctioned apps\ncurl -X GET \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fdiscovery\u002Fdiscovered_apps\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -d '{\n    \"filters\": {\n      \"appTag\": {\"eq\": \"unsanctioned\"},\n      \"traffic\": {\"gte\": 1000}\n    },\n    \"sortField\": \"traffic\",\n    \"sortDirection\": \"desc\"\n  }'\n\n# Create session policy for DLP enforcement\ncurl -X POST \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fpolicies\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -d '{\n    \"name\": \"Block PII Upload to SaaS\",\n    \"policyType\": \"SESSION\",\n    \"severity\": \"HIGH\",\n    \"enabled\": true,\n    \"sessionPolicyType\": \"CONTROL_UPLOAD\",\n    \"filters\": {\n      \"fileType\": {\"eq\": [\"DOCUMENT\", \"SPREADSHEET\"]},\n      \"contentInspection\": {\n        \"dataType\": [\"CREDIT_CARD\", \"SSN\", \"PASSPORT\"]\n      }\n    },\n    \"actions\": {\n      \"block\": true,\n      \"notify\": {\n        \"emailRecipients\": [\"security-team@company.com\"]\n      }\n    }\n  }'\n```\n\n### Step 4: Configure OAuth App Governance\n\nReview and restrict OAuth application permissions to prevent excessive consent.\n\n```powershell\n# Query OAuth apps with high-privilege permissions\n$oauthApps = Invoke-MgGraphRequest -Method GET `\n  \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FservicePrincipals?\\$filter=tags\u002Fany(t:t eq 'WindowsAzureActiveDirectoryIntegratedApp')&\\$select=displayName,appId,oauth2PermissionScopes\"\n\n# Review consent grants\n$grants = Get-MgOauth2PermissionGrant -All\n$highRisk = $grants | Where-Object {\n    $_.Scope -match \"Mail.ReadWrite|Files.ReadWrite.All|Directory.ReadWrite.All\"\n}\n\nWrite-Host \"High-risk OAuth grants: $($highRisk.Count)\"\n$highRisk | ForEach-Object {\n    $sp = Get-MgServicePrincipal -ServicePrincipalId $_.ClientId\n    Write-Host \"  App: $($sp.DisplayName) | Scope: $($_.Scope) | Type: $($_.ConsentType)\"\n}\n\n# Configure app consent policy to require admin approval\n$consentPolicy = @{\n    displayName = \"Require Admin Approval for High-Risk Permissions\"\n    conditions = @{\n        clientApplications = @{ includeAllClientApplications = $true }\n        permissions = @{\n            permissionClassification = \"high\"\n            permissions = @(\n                @{ permissionValue = \"Mail.ReadWrite\"; permissionType = \"delegated\" }\n                @{ permissionValue = \"Files.ReadWrite.All\"; permissionType = \"delegated\" }\n            )\n        }\n    }\n}\n```\n\n### Step 5: Implement SaaS Security Posture Management (SSPM)\n\nAudit and remediate SaaS security configuration drift.\n\n```bash\n# Query SaaS security posture via CASB API\ncurl -X GET \"https:\u002F\u002Fapi.cloudappsecurity.com\u002Fapi\u002Fv1\u002Fsecurity_config\u002F\" \\\n  -H \"Authorization: Token ${MDCA_API_TOKEN}\" \\\n  -d '{\"app\": \"Microsoft 365\"}'\n\n# Common SSPM checks:\n# - MFA enforcement for all admin accounts\n# - External sharing restrictions in SharePoint\u002FOneDrive\n# - Email forwarding rules to external domains blocked\n# - Idle session timeout configured (\u003C 8 hours)\n# - Legacy authentication protocols disabled\n# - Admin consent workflow enabled\n# - Conditional access policies active\n# - Audit logging enabled for all services\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CASB | Cloud Access Security Broker - intermediary enforcing security policies between users and SaaS applications |\n| SSPM | SaaS Security Posture Management - continuous monitoring of SaaS application security configurations |\n| OAuth Governance | Review and control of third-party application permissions granted through OAuth consent flows |\n| Session Controls | Real-time access restrictions (block downloads, DLP inspection, watermarking) applied during active SaaS sessions |\n| Shadow IT | Unauthorized SaaS applications used by employees without IT approval or security review |\n| Conditional Access | Policy engine evaluating identity, device, location, and risk signals before granting SaaS access |\n\n## Tools & Systems\n\n- **Microsoft Defender for Cloud Apps**: CASB providing shadow IT discovery, session controls, DLP, and SSPM\n- **Microsoft Entra ID Conditional Access**: Policy engine for identity-based access control to SaaS applications\n- **Netskope CASB**: Cloud-native CASB with inline and API-based SaaS security controls\n- **Okta Identity Governance**: OAuth app governance and access certification for SaaS applications\n- **SSPM Tools**: AppOmni, Adaptive Shield, Valence Security for SaaS configuration monitoring\n\n## Common Scenarios\n\n### Scenario: Securing Microsoft 365 and Salesforce for 1,000-User Organization\n\n**Context**: A professional services firm with 1,000 users uses Microsoft 365, Salesforce, Slack, and 20+ other SaaS apps. Several data breaches in the industry drive a zero trust initiative for all SaaS access.\n\n**Approach**:\n1. Federate all SaaS authentication through Entra ID with SAML SSO\n2. Create conditional access policies requiring MFA + compliant device for all SaaS apps\n3. Deploy Defender for Cloud Apps for shadow IT discovery (identify 150+ unauthorized apps)\n4. Mark unauthorized apps as unsanctioned and block via SWG\u002Fproxy\n5. Configure session controls: block downloads on unmanaged devices, DLP for file uploads\n6. Review OAuth app permissions: revoke 45 high-risk consent grants, enable admin approval workflow\n7. Enable SSPM monitoring for Microsoft 365 and Salesforce configurations\n8. Set up weekly automated posture reports for security leadership\n\n**Pitfalls**: Conditional access policies need break-glass exclusions. Some legacy SaaS apps may not support modern authentication. Session controls require proxy-based CASB which can impact performance. OAuth app revocation may break integrations; coordinate with app owners first.\n\n## Output Format\n\n```\nZero Trust SaaS Security Report\n==================================================\nOrganization: ProServices Corp\nReport Date: 2026-02-23\n\nSAAS INVENTORY:\n  Sanctioned Apps: 25\n  Unsanctioned (blocked): 127\n  Shadow IT Users: 342 (discovered in last 30 days)\n\nCONDITIONAL ACCESS:\n  Policies active: 8\n  Sign-ins evaluated: 456,789\n  Blocked by policy: 2,345 (0.5%)\n  MFA enforced: 100% of sign-ins\n\nDEVICE COMPLIANCE:\n  Compliant device required: All 25 sanctioned apps\n  Sign-ins from compliant: 448,123 (98.1%)\n  Sign-ins blocked (non-compliant): 8,666\n\nCASB \u002F DLP:\n  DLP violations detected: 89\n  Files blocked from upload: 34\n  Downloads blocked (unmanaged): 1,234\n\nOAUTH GOVERNANCE:\n  Total OAuth apps: 312\n  High-risk permissions: 12 (reviewed)\n  Revoked consents: 45\n  Pending admin approval: 8\n\nSSPM FINDINGS:\n  Critical misconfigurations: 3\n  High: 7\n  Medium: 15\n  Remediated this month: 18\n```\n",{"name":5,"tags":25,"author":33,"domain":34,"license":15,"version":35,"nist_csf":36,"subdomain":41,"description":7,"mitre_attack":42},[26,27,28,29,30,31,32],"zero-trust","saas-security","casb","sspm","conditional-access","oauth-governance","session-controls","mahipal","cybersecurity","1.0",[37,38,39,40],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[43,44,45,46,47],"T1078","T1190","T1059","T1078.004","T1530","main","8a3b3de73262a4c4db64523949360f3c599c2fb1","Anthropic-Cybersecurity-Skills-main\u002Fskills\u002Fimplementing-zero-trust-for-saas-applications",0,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use","https:\u002F\u002Fgithub.com\u002FSaiVatsal","https:\u002F\u002Fsaivatsal.github.io\u002FPortfolio\u002F","The Longer It Takes The Stronger It Becomes ","2026-09-21 22:45:58",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add SaiVatsal\u002FSkills-I-Use --skill implementing-zero-trust-for-saas-applications",{"tool":63,"command":64},"bunx","bunx skills add SaiVatsal\u002FSkills-I-Use --skill implementing-zero-trust-for-saas-applications",{"tool":66,"command":67},"pnpm","pnpm dlx skills add SaiVatsal\u002FSkills-I-Use --skill implementing-zero-trust-for-saas-applications","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fimplementing-zero-trust-for-saas-applications\u002FSKILL.md",true,[71,75,81],{"path":72,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-reference.md","REFERENCE","参考文档",1717,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fimplementing-zero-trust-for-saas-applications\u002Freferences\u002Fapi-reference.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fagent.py","SCRIPT","脚本",5929,"https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002FAnthropic-Cybersecurity-Skills-main\u002Fskills\u002Fimplementing-zero-trust-for-saas-applications\u002Fscripts\u002Fagent.py",[88,96,104,113,120,127],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":92,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":20},"01M7DJZP6E6KMBQV4CZSDPZEZ8","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fwebapp-testing\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":100,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":20},"01M7DJZFTS5TS06K2TV3MDTE67","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fweb-artifacts-builder\u002FSKILL.md",[],[],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":20},"01M7DJRK4SRQ908F2TJM6EZ7EV","ui-styling","Create beautiful, accessible user interfaces with shadcn\u002Fui components (built on Radix UI + Tailwind), Tailwind CSS utility-first styling, and canvas-based visual designs. Use when building user interfaces, implementing design systems, creating responsive layouts, adding accessible components (dialogs, dropdowns, forms, tables), customizing themes and colors, implementing dark mode, generating visual designs and posters, or establishing consistent styling patterns across applications.","MIT","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fui-styling\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fui-styling\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":20},"01M7DJR902059VEQP23PVM2WA0","design","Comprehensive design skill: brand identity, design tokens, UI styling, logo generation (55 styles, Gemini AI), corporate identity program (50 deliverables, CIP mockups), HTML presentations (Chart.js), banner design (22 styles, social\u002Fads\u002Fweb\u002Fprint), icon design (15 styles, SVG, Gemini 3.1 Pro), social photos (HTML→screenshot, multi-platform). Actions: design logo, create CIP, generate mockups, build slides, design banner, generate icon, create social photos, social media images, brand identity, design system. Platforms: Facebook, Twitter, LinkedIn, YouTube, Instagram, Pinterest, TikTok, Threads, Google Ads.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fdesign\u002FSKILL.md",[],[],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":20},"01M7DJR56QF5N6XYTCPCFHFMNP","design-system","Token architecture, component specifications, and slide generation. Three-layer tokens (primitive→semantic→component), CSS variables, spacing\u002Ftypography scales, component specs, strategic slide creation. Use for design tokens, systematic design, brand-compliant presentations.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fdesign-system\u002FSKILL.md",[],[],{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":20},"01M7DJQXB6M0SFF7NX8J5N01AH","banner-design","Design banners for social media, ads, website heroes, creative assets, and print. Multiple art direction options with AI-generated visuals. Actions: design, create, generate banner. Platforms: Facebook, Twitter\u002FX, LinkedIn, YouTube, Instagram, Google Display, website hero, print. Styles: minimalist, gradient, bold typography, photo-based, illustrated, geometric, retro, glassmorphism, 3D, neon, duotone, editorial, collage. Uses ui-ux-pro-max, frontend-design, ai-artist, ai-multimodal skills.","https:\u002F\u002Fgithub.com\u002FSaiVatsal\u002FSkills-I-Use\u002Fblob\u002Fmain\u002Fui-ux-pro-max-skill-main\u002Fcli\u002Fassets\u002Fskills\u002Fbanner-design\u002FSKILL.md",[],[]]