You have a Microsoft 365 subscription. You need to identify which shadow IT apps users connect to by using Cloud Discovery in Microsoft Defender for Cloud Apps. What should you create first?

Question

Options

• Aa Cloud Discovery snapshot report
• Ba session policy
• Can app discovery policy
• Da Conditional Access policy

• A
  86% (24)
• B
  4% (1)
• C
  7% (2)
• D
  4% (1)

Explanation

You should first create a Cloud Discovery snapshot report (A). Cloud Discovery works by analyzing network traffic logs (from firewalls, proxies, or web gateways) to identify which cloud apps users are accessing - this is the foundation of shadow IT visibility. A snapshot report is generated by manually uploading traffic log files to Defender for Cloud Apps, and it immediately shows discovered apps, usage statistics, and risk scores. This is the required first step before any policies can be applied, because Defender for Cloud Apps needs log data to have visibility. A session policy (B) requires Conditional Access App Control already deployed, an app discovery policy (C) alerts on new apps found but requires Cloud Discovery already running, and a Conditional Access policy (D) is for access control, not discovery.

No community discussion yet for this question.