You have an Azure AD tenant. You discover that a large number of new apps were added to the tenant. You need to implement an approval process for new enterprise applications. What should you do?

Question

Options

• AFrom the Microsoft Defender for Cloud Apps portal, create a Cloud Discovery anomaly detection
• BFrom the Microsoft Entra admin center, configure the Admin consent settings.
• CFrom the Microsoft Defender for Cloud Apps portal, configure an app connector.
• DFrom the Microsoft Entra admin center, configure an access review.

• A
  5% (2)
• B
  85% (34)
• C
  8% (3)
• D
  3% (1)

Explanation

Explanation

Configuring Admin Consent Settings in the Microsoft Entra admin center is the correct approach because it allows administrators to require user consent requests for new enterprise applications to go through a formal approval workflow, preventing apps from being added without oversight. This directly addresses the need for an approval process by enabling admins to review, approve, or deny application consent requests before apps are granted access to the tenant.

Why the distractors are wrong:

• Option A (Cloud Discovery anomaly detection) detects unusual patterns in cloud app usage, not an approval process for new app registrations.
• Option C (App connector) connects existing sanctioned apps to Defender for Cloud Apps for monitoring - it doesn't control or gate new app additions.
• Option D (Access review) is used to periodically review existing user/group access to resources, not to implement an approval gate for newly added applications.

Memory Tip

Think of Admin Consent = Approval Gate: whenever you see "approval process for enterprise apps," link it to consent - who has the right to consent to apps entering your tenant is controlled by Admin Consent Settings in Entra. If it involves approving apps, it's a consent problem, not a monitoring or review problem.

No community discussion yet for this question.