The current implementation only accepts url logs as stated above.  You will have to deploy a Cloud Discovery server on-prem or in Azure.  Once completed you forward your logs to this server on UDP 514 and the logs will start flowing into your Cloud App Security Portal.   https://docs.microsoft.com/en-us/cloud-app-security/set-up-cloud-discovery ... View more