You have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps and has Cloud Discovery enabled. You need to enrich the Cloud Discovery data. The solution must ensure that…

Conditional Access App Control is used for real-time monitoring and control of access to cloud apps, not for enriching historical Cloud Discovery data with UPNs from traffic logs. User monitoring within CAAC focuses on session policies.

Creating a Microsoft 365 app connector allows Microsoft Defender for Cloud Apps to integrate with Microsoft Entra ID, enabling it to retrieve detailed user information, group memberships, and activity data. This integration is crucial for enriching Cloud Discovery logs by resolving usernames from traffic data to their corresponding Microsoft Entra ID UPNs and other identity attributes.

Enabling automatic redirection to Microsoft 365 Defender is a configuration for integrating security portals, but it does not directly enable the mapping of usernames from raw traffic logs to Entra ID UPNs within Defender for Cloud Apps.

An Azure app connector is used for connecting to Azure services for governance and security within Defender for Cloud Apps, which is different from connecting to Microsoft Entra ID for user identity resolution in Cloud Discovery.