Question

Your organization uses Microsoft 365 with Defender for Cloud Apps. Security requires the ability to detect and revoke risky OAuth application grants in Exchange Online, SharePoint, and Teams, and to suspend a specific user account directly from a Cloud Apps alert. Currently, only Cloud App Discovery is configured using firewall log uploads. What must you do first to enable these governance actions on Microsoft 365 data?

Accepted Answer

Connect the Microsoft 365 app connector in the Defender for Cloud Apps portal

Answer

Deploy a Conditional Access session policy to route Microsoft 365 traffic through the reverse proxy

Answer

Upload additional continuous firewall log snapshots to expand the Cloud Discovery data set

Answer

Create a Cloud Discovery app tagging rule to mark the Microsoft 365 apps as sanctioned