You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps. You need to identify which users access Facebook from their devices and browsers. The solution must minimize…

Question

Options

• AFrom the Microsoft 365 Defender portal, unsanction Facebook.
• BCreate a Defender for Cloud Apps access policy.
• CCreate an app configuration policy in Microsoft Intune.
• DCreate a Conditional Access policy.

• A
  81% (17)
• B
  10% (2)
• C
  5% (1)
• D
  5% (1)

Explanation

Explanation

Unsanctioning Facebook in the Microsoft 365 Defender portal tags it as a blocked/monitored app, which causes Defender for Cloud Apps to automatically generate Shadow IT discovery reports - revealing which users are accessing Facebook from their devices and browsers with minimal configuration effort. Option B (an Access Policy) is incorrect because access policies control conditional access to sanctioned apps and require more setup, not just identification of usage. Option C (an Intune app configuration policy) manages app settings on enrolled devices but doesn't provide visibility into browser-based Facebook access. Option D (a Conditional Access policy) can block or control access but is a more complex solution and doesn't directly identify which users are accessing the app the way unsanctioning does in Cloud App Discovery.

Memory Tip: Think of unsanctioning = shining a spotlight - when you mark an app as unsanctioned in Defender for Cloud Apps, you're telling the system "watch this," which triggers automatic monitoring and discovery reports. Always unsanction first to identify, then enforce controls later.

No community discussion yet for this question.