One of the first things you need to do is to define your internal domains. SaaS Security API uses the list of internal domains you define to determine if the Collaborators on an asset are internal to your company, or if the asset shared with external users. SaaS Security API determines this by matching the domain name in a collaborator’s email address against the list of internal domains defined. Depending on your policy rules, SaaS Security API identifies an asset as an incident if shared with external users.

Because SaaS Security API uses the internal domains list to determine the Exposure Level of an asset during the scan process, you must define your internal domains list

before

you begin scanning your cloud apps. Additionally, you can build in flexibility when you define your internal domains:

When you modify the internal domains list, consider that you might need to update the exposure, depending on the discovery state for a given asset: