Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRMedium
An organization is deploying Microsoft Defender for Cloud Apps (MDCAS) and has identified several unsanctioned cloud applications being used by employees. The security team wants to monitor these unsanctioned apps for specific risky activities, such as data downloads or uploads, without blocking access to them entirely. Which type of policy in MDCAS should they configure to achieve this granular monitoring?
- AActivity policy
- BFile policy
- CSession policy
- DAccess policy
Show answer & explanationAnswer & explanation
Correct answer: A. Activity policy
Activity policies in MDCAS are designed to monitor specific user activities within sanctioned or unsanctioned cloud applications. They can generate alerts for actions like downloads, uploads, or administrative changes, without necessarily blocking the activity, which aligns with the requirement for granular monitoring without blocking access.
Why the other options are wrong
- B. File policies focus on sensitive data within files (e.g., content inspection), not general user activities like logins or downloads.
- C. Session policies provide real-time control during a session (e.g., block download), but the question emphasizes monitoring for specific activities on unsanctioned apps, which is more aligned with Activity policies.
- D. Access policies control whether users can access an app at all, which goes against the 'without blocking access' requirement.
MDCAS Activity Policy
A Microsoft Defender for Cloud Apps policy used to monitor specific user activities within cloud applications and generate alerts based on predefined conditions.
- Monitors activities like logins, downloads, uploads, and administrative actions.
- Can be configured to alert, but not necessarily block.
- Applies to sanctioned and unsanctioned apps.
Memory trick: Activity policies watch what you DO, not just where you go or what you touch.