Question

During an incident in Microsoft Defender XDR, an alert from Microsoft Defender for Cloud Apps flags a third-party OAuth application in your Entra ID tenant as malicious. The app was granted delegated Mail.Read and Files.ReadWrite.All permissions by 40 users after a phishing campaign. You must immediately stop the app from accessing tenant data while preserving evidence for further investigation. Which action in the Defender XDR portal best meets this requirement?

Accepted Answer

Suspend (disable) the OAuth application from the app governance / OAuth apps page, which revokes its tokens and blocks tenant access

Answer

Disable the individual user accounts that consented to the application

Answer

Delete the enterprise application object from Entra ID immediately

Answer

Create a Conditional Access policy that blocks legacy authentication for all users