Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRHard
A security engineer is configuring Microsoft Defender for Cloud Apps (MDCAS) to ensure that users accessing sanctioned cloud applications from unmanaged devices are restricted from downloading sensitive company data. They need to implement a policy that detects when a user attempts a download from a specific sanctioned app on an unmanaged device and automatically blocks the download, while also allowing other activities like viewing the data. Which MDCAS policy type should be used?
- AActivity policy
- BAccess policy
- CFile policy
- DSession policy
Show answer & explanationAnswer & explanation
Correct answer: D. Session policy
Session policies in Microsoft Defender for Cloud Apps are specifically designed to monitor and control user sessions in real-time, allowing granular actions like blocking downloads, preventing copy-paste, or requiring justification for specific activities based on conditions like 'unmanaged device' and 'sanctioned app'.
Why the other options are wrong
- A. Activity policies can block specific activities but typically act on a 'per-activity' basis rather than providing real-time, in-session control for specific actions like 'block download' while allowing 'view'.
- B. Access policies control initial access to an application (allow/block), not specific actions within an active session.
- C. File policies focus on sensitive content within files themselves, not on controlling download actions based on device management status.
Session Policy (MDCAS)
A real-time control policy in Microsoft Defender for Cloud Apps that monitors and governs user actions within a cloud application session.
- Enforces granular controls like 'block download' or 'protect on download'.
- Uses reverse proxy architecture for real-time monitoring.
- Ideal for managing access from unmanaged or risky devices.
Memory trick: Session Policies Guard Data During App Use.