Try our new research platform with insights from 80,000+ expert users

Anomali vs Microsoft Defender for Cloud Apps comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jul 6, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Anomali
Ranking in Advanced Threat Protection (ATP)
22nd
Average Rating
7.8
Reviews Sentiment
7.2
Number of Reviews
4
Ranking in other categories
Security Information and Event Management (SIEM) (32nd), User Entity Behavior Analytics (UEBA) (19th), Threat Intelligence Platforms (TIP) (8th), Extended Detection and Response (XDR) (26th)
Microsoft Defender for Clou...
Ranking in Advanced Threat Protection (ATP)
14th
Average Rating
8.4
Reviews Sentiment
7.3
Number of Reviews
40
Ranking in other categories
Cloud Access Security Brokers (CASB) (4th), Microsoft Security Suite (12th)
 

Mindshare comparison

As of October 2025, in the Advanced Threat Protection (ATP) category, the mindshare of Anomali is 1.4%, up from 1.1% compared to the previous year. The mindshare of Microsoft Defender for Cloud Apps is 1.8%, up from 1.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Advanced Threat Protection (ATP) Market Share Distribution
ProductMarket Share (%)
Microsoft Defender for Cloud Apps1.8%
Anomali1.4%
Other96.8%
Advanced Threat Protection (ATP)
 

Featured Reviews

CC
Enables automated threat intelligence sorting and enhances proactive threat hunting capabilities
You have to have at least a threat intelligence background or a SOC analyst background to use it, as that's the information you'll dig around with in there. If you don't have that kind of knowledge, it probably can be a little hard to use, but they do provide training. They offer training not only for how to use the platform but also some basic threat intelligence training to explain what these things are and what these terms mean. My company is a customer of Anomali. I would recommend it to other people. I would advise making sure you don't pick it without testing other products and have your use cases well thought out and documented before testing, so you know it will solve the problems you're trying to address. Keep an open mind with it and realize that whatever you can dream of, you can probably do with the platform. Overall, I would rate Anomali an eight out of ten.
Abdulrahman Muhammadi - PeerSpot reviewer
Integration with existing cloud workflows has simplified compliance and threat detection
Licensing cost is a significant concern. With Defender Plan 1, Microsoft Defender for Cloud Apps comes with a pay-per-use model. Each feature has its own pricing when activated on VMs. For example, the vulnerability assessment has separate pricing, the base model including encryptions has separate pricing, and the compliance features have separate pricing. This applies to each VM and Azure resource individually. It is not straightforward where you can take one license and apply it to everything. Each feature has its own pricing model which can be tedious, as the costs keep accumulating. The only lacking feature currently is XDR (extended detection and response). Apart from that, I have only positive experiences with the whole Microsoft suite, except for the pricing structure.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We now have a very robust collection of threat intelligence based on the capabilities that Anomali provides."
"The most valuable aspect of Anomali is the threat modeling capability."
"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."
"The feature I have found most valuable is credential monitoring. This feature is easy and quick."
"The ability to prevent users from using certain applications is one of the most valuable features. It doesn't require any configuration for implementation from the client perspective. It just works right away and gives you the information you need."
"I like the alert policies because they are quite robust. It has some built-in templates that we can easily pick up. One of them is the alert for mass downloads, when a particular user is running a massive download on your SharePoint site."
"One of the most valuable features is auditing. Some of the other protection services have issues with auditing. Microsoft Defender for Cloud has an excellent auditing technique that helps us avoid the risk of filtering or information loss. You can use different tools to guarantee these things. It allows you to conduct an in-depth exploration of applications, users, and files that are harmful or suspicious. You can also enhance your security setup by creating personalized rules or policies that help you better control traffic in the cloud."
"It is very easy to use, which is what we look for in these types of solutions."
"Microsoft Defender for Cloud Apps is very comprehensive, providing a complete 360-degree view of applications within an organization."
"In Microsoft Defender for Cloud Apps, there is an option to enable files. Once you enable that, it will give you all the files in your organization and where they are located in the cloud... That feature is very useful for investigation purposes."
"The most effective features for data protection are data loss prevention (DLP) and data classification."
"It's very easy to install and it includes the Intune portal from Microsoft where I can control all the devices from one place."
 

Cons

"A lot of tools can give you many features, such as CTI intelligence and a tax service reduction. However, many people are combining different tools together to have more capabilities. It is up to the consumer whether they want to have multiple tools or have one tool that serves the purpose. Anomali Enterprise could improve by combining all the other tools' features into one solution."
"Support in the past has been top-notch, but recent trends indicate that it has taken a back seat, as we often don't get answers for days."
"Less code in integration would be nice when building blocks."
"An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting."
"Microsoft Defender for Cloud Apps’s technical support services needs improvement."
"Defender for Cloud apps is primarily useful for Azure apps. It has limited capabilities for applications based on other cloud platforms."
"I would prefer to have filtering options incorporated within the policies, enabling the solution to perform tasks beyond mere blocking or allowing."
"We are having trouble with our continuous reporting configuration and struggling with configuring the collector properly with our log parsing."
"We would like to get more information from the endpoint. I don't get enough detailed information right now on why something failed. There is not enough visibility."
"I would like more customization of notifications. Currently, you either get everything or you get limited information. I would like to have something in between where we can customize the data that is included in notifications."
"Currently, reporting is not very straightforward and it needs to be enhanced. Specific reports are not included and you need to run a query, drill down, and then export it and share it. I would love to have reports with more fine-tuning or granularity, and more predefined reports."
"I would like for it to be available on Mac and for it to support all of the features of Microsoft financing products. It is really for Windows."
 

Pricing and Cost Advice

"When comparing the price of Anomali Enterprise to other solutions it is in the medium to high range. However, I am satisfied with the price."
"The E5 license offers everything bundled. People are moving to Microsoft because you buy one license and it gives you everything."
"We are an MST and we do not pay for the solution. However, the price of the solution could be better."
"The pricing is fair."
"We utilize the Microsoft E5 licensing, which encompasses the entire Microsoft suite; however, it is costly."
"This product is not expensive."
"It has fair pricing. You pay for what you get. As far as I know, there are no costs in addition to the standard licensing fee."
"We have an educational licensing agreement. It's a customer agreement for multiple years."
"Where we are right now, this is an acceptable pricing. I would like to see more transparency given to the end user. The end user given to us is via the cloud service provider. There are different programs and license models. Some include this, and some include that. It is all over the place. There can be a little more consistency or simplification in the pricing so that your parts list is not ten pages long, and you are not trying to determine, "If I have an E3, does this cover that?", or "Do I need to pay separately for the license?" Simplification would probably be better."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
869,566 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
12%
Government
7%
Educational Organization
7%
Computer Software Company
12%
Financial Services Firm
10%
Manufacturing Company
9%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business13
Midsize Enterprise10
Large Enterprise18
 

Questions from the Community

What needs improvement with Anomali ThreatStream?
An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting. Combining all aliases ...
What is your primary use case for Anomali ThreatStream?
I use Anomali ( /products/anomali-reviews ) for threat hunting, threat collection, operationalization of intelligence, such as indicators of compromise (IOCs), and dissemination of reports for repo...
What advice do you have for others considering Anomali ThreatStream?
For new users, I recommend taking the training provided by Anomali as it is very well articulated. I advise reading the user manual and taking the instructor-led training sessions from the customer...
Which is the better security solution - Cisco Umbrella or Microsoft Cloud App Security?
Cisco Umbrella is an integral component of the Cisco SASE architecture. It integrates security in a single, cloud-native solution, unifying multiple features like DNS-layer security, threat intelli...
What do you like most about Microsoft Cloud App Security?
It does a great job of monitoring and maintaining a security baseline. For us, that is a key element. The notifications are pretty good.
What is your experience regarding pricing and costs for Microsoft Cloud App Security?
At the time of implementation, when the size of our organization was small, it was a more affordable product. Since all our productivity applications were on O365, Microsoft Defender for Cloud Apps...
 

Also Known As

Match, Lens, ThreatStream, STAXX, Anomali Security Analytics
MS Cloud App Security, Microsoft Cloud App Security
 

Overview

 

Sample Customers

Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network
Customers for Microsoft Defender for Cloud Apps include Accenture, St. Luke’s University Health Network, Ansell, and Nakilat.
Find out what your peers are saying about Anomali vs. Microsoft Defender for Cloud Apps and other solutions. Updated: September 2025.
869,566 professionals have used our research since 2012.