The Microsoft world is full of acronyms and seemingly overlapping tools and services. When talking about CAS, it's wise to seek clarification when discussing licensing or functionality.
In CAS alone, there are Microsoft Cloud App Security (MCAS) and Office 365 Cloud App Security (OCAS). MCAS can connect to over 16,000 apps, while OCAS can only connect to about 750: basically, those that are Office 365 or similar in functionality. Another difference lies in deployment for discovery analysis. MCAS is the only option that allows automatic log uploading; OCAS provides only manual uploading.
If you intend to integrate with Azure Information Protection (AIP), you'll need to use MCAS.
See a complete list of differences between MCAS and OCAS at https://docs.microsoft.com/en-us/cloud-app-security/editions-cloud-app-security-o365.
As far as licensing is...