Question

A financial services firm allows employees to use several sanctioned SaaS applications (including a marketing analytics platform) that are accessed through the browser. The security architect must ensure that when a user attempts to download a file containing customer credit card numbers from any of these SaaS apps to an unmanaged personal device, the download is blocked in near real time — even though the file resides in a third-party SaaS store, not in Microsoft 365. Sensitivity labeling and Microsoft 365 DLP policies are already deployed for SharePoint, OneDrive, and Exchange. Which solution should the architect design to enforce this control?

Accepted Answer

Configure a Microsoft Defender for Cloud Apps session policy (via Conditional Access App Control) that inspects downloads for sensitive content and blocks them for unmanaged devices

Answer

Extend the existing Microsoft 365 DLP policy to include the third-party SaaS application as a location

Answer

Deploy Microsoft Purview Endpoint DLP to every personal device and block downloads at the OS level

Answer

Create a Conditional Access policy that blocks all access to the SaaS apps from unmanaged devices