Use Case: SaaS
SaaS misconfiguration drift
An admin disabled conditional access for the executive team's accounts 'temporarily' during travel. 3 weeks later, the policy was still off. ManySignal had flagged the change on day 1.
The security setting that was changed by someone else
SaaS misconfiguration is not a static problem — it's a continuous drift problem. A correctly configured tenant today can have dozens of security-relevant settings changed by next week: an admin adds an external user to a Slack workspace, legacy authentication is re-enabled for a vendor integration, a GitHub Actions permission setting is relaxed to unblock a deployment. Each change makes sense to the person who made it. None of them generate a security alert. And they accumulate.
detection: saas_configuration_drift
type: config_change + benchmark_validation
sources:
- microsoft_365_graph_api (config polling)
- google_workspace_admin_sdk
- okta_admin_api
- github_organization_api
- salesforce_metadata_api
process:
- poll: security_relevant_settings every 15m
- compare: current_value vs compliance_benchmark
- alert: when value transitions from PASS to FAIL
- include: change_actor, change_time, specific_delta
benchmark_sources:
- cis_microsoft_365_benchmark_v3.0
- cis_google_workspace_benchmark_v2.0
- manysignal_threat_informed_additions
mitre: T1562.001 (Disable or Modify Tools)MITRE ATT&CK mapping
SaaS misconfiguration FAQ
What SaaS platforms does ManySignal assess for misconfiguration?
Microsoft 365 (SharePoint, Teams, Exchange, Entra ID), Google Workspace, Salesforce, GitHub, Slack, Zoom, Box, Dropbox Business, Okta, and Atlassian (Jira, Confluence). Each platform has a specific configuration benchmark based on CIS, vendor security guides, and ManySignal's threat intelligence on commonly exploited misconfigurations.
What are the most commonly exploited SaaS misconfigurations?
Microsoft 365: legacy authentication enabled, external email forwarding unrestricted, conditional access gaps for high-risk locations. Google Workspace: 2-step verification not enforced, external sharing unrestricted, Google Groups public by default. Salesforce: guest user access enabled, sharing settings too broad. GitHub: branch protection missing on main, Actions allowed from all repositories.
How is SaaS misconfiguration drift different from a one-time CSPM scan?
CSPM scans SaaS configurations on demand or on a schedule. Drift detection monitors every configuration change in real time and alerts when a setting moves from a compliant to a non-compliant state. This catches misconfiguration at the moment of change — before it's exploited — rather than discovering it in the next scheduled scan.
Does ManySignal provide remediation steps or just detect?
For each detected misconfiguration, ManySignal provides: the specific setting that's wrong, the recommended value, the security risk associated with the current setting, the exact UI path or API call to remediate, and (for supported platforms) an option to remediate directly via the ManySignal response workflow.
Know when your SaaS security settings drift from baseline
Real-time configuration monitoring across M365, Google Workspace, Okta, and GitHub with CIS benchmark validation.