Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Defender XDREasy
A Microsoft 365 administrator is reviewing the security posture of their organization using Microsoft Defender XDR. They notice a significant number of alerts related to users accessing cloud applications that are not approved by the company's IT policy. The administrator needs to gain better visibility into all cloud applications being used by employees, sanctioned or unsanctioned, and assess their risk levels. Which component of Microsoft Defender for Cloud Apps provides this capability?
- AAPI Connectors
- BCloud Discovery
- CConditional Access App Control
- DApp governance
Show answer & explanationAnswer & explanation
Correct answer: B. Cloud Discovery
Cloud Discovery in Microsoft Defender for Cloud Apps is specifically designed to identify all cloud applications accessed by users, assess their risk, and detect 'shadow IT' usage, providing the visibility required to manage both sanctioned and unsanctioned apps.
Why the other options are wrong
- A. API Connectors integrate Defender for Cloud Apps with other cloud apps to pull data and enforce policies but are not the primary mechanism for initial cloud app discovery.
- C. Conditional Access App Control provides real-time monitoring and control over access and activities within sanctioned apps, but it doesn't discover new unsanctioned apps.
- D. App governance focuses on managing and securing OAuth-enabled and API-connected apps within the Microsoft Graph ecosystem, not discovering all cloud apps in use.
Defender for Cloud Apps Cloud Discovery
Cloud Discovery in Microsoft Defender for Cloud Apps identifies all cloud applications used across an organization, assesses their risk, and detects shadow IT.
- Uses traffic logs from firewalls, proxies, and endpoints.
- Provides a risk score for each discovered app.
- Helps identify sanctioned vs. unsanctioned cloud services.
- Crucial for gaining visibility into an organization's cloud app landscape.
Memory trick: To DISCOVER all cloud apps, you need CLOUD DISCOVERY.