PRACTICE / MODULE 017 / MICROSOFT DEFENDER

The app is approved.
Is the data protected?

Investigate Shadow IT, evaluate risky OAuth permissions and apply least-privilege cloud app controls. Two Northstar incidents test evidence-led security decisions.

← Review the Learn guide SC-300 objective map →

03 / APPLY THE DECISIONS

Triage the cloud app evidence.

Two original Northstar Services investigations: Shadow IT data exfiltration concerns and a risky OAuth grant with a browser-session enforcement gap. Defensible decisions advance each case.

NORTHSTAR SERVICES / SEC-341 · A spike in uploads to an unfamiliar file-sharing appSECURITY INVESTIGATION

Shadow IT discovery

Northstar's help desk reports a possible unapproved SaaS service. Use evidence before blocking users.

STEP 1 OF 3

Cloud Discovery shows no matching app, but endpoint telemetry records traffic from eight users. What do you check first?

LEARN → PRACTICE → LAB → TROUBLESHOOT

Trace discovery. Validate permissions. Protect the session.

Return to the guide or use the SC-300 objective map to explore connected application and identity defenses.

Review the Learn guide →