Prepare for SC-200 with a reference that remembers your progress.

Defender for Cloud Apps balances cloud productivity with visibility, control over data movement, and threat analytics. The module covers Shadow IT discovery, real-time access/session controls, sensitive-information protection, and anomaly detection.

Defender for Cloud Apps is a cloud access security broker (CASB)—an enforcement point between users and cloud providers. Its four framework pillars are:

1. Discover and control Shadow IT across SaaS, IaaS, and PaaS.
2. Protect sensitive information with classification and DLP.
3. Protect against threats and anomalies with UEBA, machine learning, and rules.
4. Assess cloud-app compliance against organizational and regulatory requirements.

Cloud Discovery analyzes traffic logs against a catalog of more than 16,000 apps and scores them using over 80 risk factors. The dashboard summarizes usage, alerts, risk, top users, source IPs, categories, and app headquarters.

1. Review high-level usage and top users/IPs.
2. Analyze categories and sanctioned usage.
3. Inspect discovered apps and risk scores from 1–10.
4. Mark risky apps Unsanctioned.
5. Use Defender for Endpoint integration to block unsanctioned apps automatically.

Conditional Access App Control uses a reverse-proxy session to enforce controls in real time. Entra Conditional Access decides who, what, and where; eligible sessions are routed through Defender for Cloud Apps for access and session policies.

• Block download, copy, cut, or print on unmanaged devices.
• Protect files on download with classification and encryption.
• Block upload of unlabeled files.
• Monitor risky sessions and user actions.
• Block access or application-specific activities, such as Teams messages containing sensitive data.

The walkthrough demonstrates Cloud Discovery and Conditional Access App Control in Defender XDR: discover app use, evaluate risk, route sessions through the proxy, and enforce controls on sensitive activity.

File policies can alert, change sharing, quarantine, remove permissions, or move content to trash. Built-in DLP and Data Classification Services inspect content; Microsoft recommends DCS for unified Microsoft 365 labeling.

Common labels: Personal, Public, General, Confidential, and Highly confidential. Policies should use narrow filters to reduce false positives.

Anomaly policies use UEBA and machine learning to compare activity with organizational and user baselines. The service learns the environment for the first seven days. Detection is nondeterministic and must be tuned to manage false positives.

• Risk factors include IP reputation, failures, admin activity, dormant accounts, location, impossible travel, device/user agent, and activity rate.
• Detections include impossible travel, infrequent country, malware, ransomware, suspicious IPs, inbox forwarding, mass downloads, and unusual administration.
• Discovery anomaly policies compare sudden usage, upload, download, transaction, or user increases with the app baseline.
• Suppression and sensitivity settings help control alert fatigue.

You should be able to explain the CASB framework, discover and score Shadow IT, apply Conditional Access App Control, classify/protect sensitive information, and detect cloud anomalies.