Question

A financial services company is executing the Zero Trust adoption framework. Business units have independently adopted numerous unsanctioned SaaS applications, and the security team lacks visibility into which cloud apps are in use, what data flows to them, and whether session activity can be controlled in real time. Leadership wants a design that both discovers unsanctioned apps and enforces granular runtime controls (such as blocking downloads of sensitive files) within the Applications pillar of Zero Trust. Which design best addresses these requirements?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps with Cloud Discovery for shadow IT visibility and configure Conditional Access App Control session policies to enforce real-time controls on sanctioned apps.

Answer

Configure Microsoft Purview sensitivity labels and DLP policies to classify data, and rely on label enforcement to prevent uploads to any external SaaS application.

Answer

Implement Microsoft Entra Private Access to broker all SaaS traffic through connectors so that unsanctioned apps are blocked at the network layer.

Answer

Enable Microsoft Defender for Endpoint web content filtering to block uncategorized cloud application domains and log user browsing activity for review.