Your organization uses Microsoft Defender for Cloud Apps. Users access a SaaS application (Salesforce) that is integrated with Microsoft Entra ID for single sign-on. Security requires that when users sign in from unmanaged devices, they can view data in the app but must be prevented from downloading any files in real time. You must implement this control with the least administrative effort. What should you configure?