JUMP TO SECTIONChoose a lesson section
Not every cloud app control sees the same thing.
Microsoft Defender for Cloud Apps helps security teams discover cloud usage, evaluate risky services, investigate connected applications, and control supported sessions. Treat observation, authorization, and enforcement as separate questions: finding an application is not the same as seeing its internal activity, and assigning a label is not the same as blocking an application.
Discover, evaluate, connect, investigate.
The same Northstar cloud app can appear in a firewall log, a Cloud Discovery report, an app connector activity stream and an OAuth permission review. Each view answers a different question.
Cloud Discovery
What cloud apps did our observed users and devices access?Cloud Discovery analyzes supported endpoint and network traffic sources. Its reports show observed apps, users, IPs and usage, not every action inside a SaaS tenant. Coverage and ingestion matter: absence from a report is not proof of no usage.
VALIDATION: Validate data sources, the observed devices/networks, report window, ingestion and the app's catalog identity.Cloud app catalog
Is this service suitable for Northstar?Use the catalog's security, compliance, legal and general risk factors to prioritize an app review. Evaluate sanctioned and unsanctioned classifications against business need. The catalog rating and governance tag do not replace a documented security decision or guarantee traffic blocking.
VALIDATION: Record factor-level risk, who uses the app, business ownership and whether enforcement is integrated.Connected SaaS apps
What activity occurred inside the authorized service?An app connector uses supported SaaS APIs and permissions to surface activities, configuration and supported threat signals. It is different from Cloud Discovery traffic collection. Grant only the required integration privileges and monitor the connector's recent sync and authorization health.
VALIDATION: Check connector status, supported permissions, ingestion timestamps, and actual service events.OAuth app governance
Who granted an app durable access, and what did it do?Review consent grants, publisher, delegated and application permissions, user exposure, observed API activity and app ownership. A user signing in with MFA does not automatically make a third-party OAuth application's permission grant safe.
VALIDATION: Document the suspicious scopes and evidence, then revoke a specific grant or app access only with appropriate approval and impact analysis.Allow the sign-in. Govern the activity.
A successful sign-in does not automatically mean a Defender session policy evaluated. The difference between app-enforced restrictions and Conditional Access App Control is important for SC-300—and even more important during production troubleshooting.
Use app-enforced restrictions
Entra Conditional Access can direct a supported resource (such as SharePoint Online) to use its native limited-access mode.
Northstar example: A user on an unmanaged device can browse supported SharePoint content but should have the app's native download/sync restrictions.
This is not the same as Defender's session inspection proxy. Check which application implements the restriction and its supported client behavior.Use Conditional Access App Control
Entra Conditional Access directs a scoped, supported interactive session into Microsoft Defender for Cloud Apps, where access/session policies evaluate it.
Northstar example: An approved SaaS app requires additional session monitoring or a targeted upload/download restriction for a pilot group.
Microsoft Edge can use in-browser protection; other supported browsers may use reverse-proxy routing. Support, license and onboarding requirements apply.Defender access policy
An access policy can monitor or block access to a cloud application based on supported criteria, including supported browser and client scenarios.
Northstar example: Block access to a sensitive SaaS app from a disallowed context rather than allow the session to start.
Set the Entra Conditional Access connection and verify app/client scope. Access policies and session policies have different behavior.Defender session policy
A session policy can monitor or control supported browser activities after the session is allowed, such as sensitive downloads or uploads.
Northstar example: Permit an unmanaged-browser session but restrict downloading sensitive files where supported.
Browser session controls are not a universal native-client proxy. Validate desktop/mobile client paths separately with supported access or app-native controls.Defender session controls act on supported interactive browser sessions. A desktop or mobile client may require other controls. Verify client type, policy routing and access evidence before describing an application as protected.
Consent can outlast the interactive session.
When an unfamiliar third-party integration has broad API permissions, separate the user's identity authentication from the permissions granted to the application. Review whether the app is authorized, whether the scopes are proportionate, who granted consent, and whether its actual API behavior fits its purpose. If the evidence justifies containment, target the risky grant or application access and verify that essential integrations remain functional.
Don't break the business to prove a policy works.
Inventory the actual access paths
List the targeted SaaS resources, identities, browser and desktop clients, existing Conditional Access policies and security dependencies.
Confirm roles, support and licensing
Check Microsoft Entra ID P1 and applicable Defender for Cloud Apps entitlements; review app onboarding and supported controls for the target client.
Pilot safely
Scope a test group, preserve emergency access and use report-only or policy-impact assessment where supported before enforcing restrictions.
Validate both allow and deny cases
Record sign-in and Conditional Access results, Defender policy activity, browser behavior and native client alternatives. Confirm every expected route.
Document rollback and ongoing ownership
Keep responsible owners, exception procedures, alert triage, connector health checks and an approved rollback plan.
Defender for Cloud Apps file policies are retiring. Organizations using those file policies should plan supported Microsoft Purview DLP or auto-labeling replacements and validate coverage before the retirement date. This does not mean Cloud Discovery, app governance or session controls are all retiring.
What does the evidence actually support?
Work four simulated tickets: incomplete Shadow IT discovery, a stalled SaaS API connector, missing session interception, and a suspicious OAuth app. Pick a defensible next action, then review the explanation.
Four incidents. Three different visibility paths. One defensible decision.
Choose a case, examine the evidence and submit the safest next action.
Is that unknown file-sharing service actually in use?
AVAILABLE EVIDENCE
- Firewall and endpoint reports cover only office traffic
- Home-based devices use direct internet egress
- Cloud Discovery report has no matching entries for this app
Check Microsoft's current product guidance.
Licensing, supported application behavior and available Defender controls change. Use current Microsoft documentation for production design and the official SC-300 objective list for exam alignment.
Did you find the risk—or just the missing log?
Practice 017 adds 16 flashcards, 16 explained questions and two multi-step Northstar incident investigations.