Question

Your organization uses Microsoft Defender for Cloud Apps with the Microsoft 365 app connector enabled. Users have been consenting to third-party OAuth applications that request high-privilege permissions such as Mail.ReadWrite and full mailbox access. Security wants to be automatically alerted and have such risky OAuth apps revoked when an app with more than 50 user consents requests high-severity permissions. Which Defender for Cloud Apps capability should you configure to meet this requirement?

Accepted Answer

Create an OAuth app policy that filters on permission severity and community use, with a governance action to revoke the app

Answer

Create an activity policy that monitors sign-in activity from risky IP addresses

Answer

Enable Cloud App Discovery and upload firewall logs to identify unsanctioned apps

Answer

Create a file policy that scans mailbox content for sensitive information types