Microsoft Defender for Cloud Apps Anomaly Detection Policy: Detect Unusual User Activity
A security administrator wants to detect unusual user activity, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. Which Microsoft Defender for Cloud Apps feature should be used to create a policy for this behavior?
Quick Answer
The answer is an anomaly detection policy. This is correct because Microsoft Defender for Cloud Apps uses machine learning to establish a baseline of normal user behavior, and an anomaly detection policy specifically identifies deviations from that baseline—such as a user downloading an abnormally large number of files from SharePoint Online in a short period—by triggering alerts on unusual spikes in volume or rate. On the MS-102 exam, this concept tests your understanding of how Defender for Cloud Apps applies behavioral analytics to detect insider threats or compromised accounts, often appearing in scenario-based questions where you must choose between activity, session, or anomaly policies. A common trap is confusing anomaly detection with activity policies, but remember: activity policies look for specific, predefined actions (like a specific IP range), while anomaly detection relies on learned baselines. Memory tip: think "anomaly = abnormal baseline deviation," and you will spot the correct answer every time.
⚠ Common exam trap
A common mix-up: candidates confuse anomaly detection policies with Cloud Discovery, mistakenly thinking Cloud Discovery detects unusual user behavior, when in fact it only identifies unsanctioned cloud apps and services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly detection policy
Microsoft Defender for Cloud Apps uses anomaly detection policies to identify unusual user behavior, such as a user downloading an abnormally large number of files from SharePoint Online in a short period. These policies leverage machine learning to establish a baseline of normal activity and then trigger alerts when deviations occur, like a spike in download volume or rate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Discovery
Why it's wrong here
Cloud Discovery identifies cloud apps used in the organization but does not monitor file download anomalies.
- ✗
Conditional Access App Control
Why it's wrong here
This enforces conditional access policies on cloud apps, but does not natively create anomaly detection behaviors.
- ✓
Anomaly detection policy
Why this is correct
Anomaly detection policies can be configured to alert on unusual file download activities based on user context and volume.
- ✗
App permissions
Why it's wrong here
App permissions allows review and revocation of OAuth applications, not detection of user behavior anomalies.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security administrator is configuring Microsoft Defender for Cloud Apps. The administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Defender for Cloud Apps features must be configured? (Select the two correct options.)
hard- ✓ A.Cloud Discovery
- B.App governance
- ✓ C.Conditional Access App Control
- D.OAuth app permissions
Why A: Cloud Discovery is the correct feature because it identifies which cloud apps are in use by analyzing traffic logs from the organization's network. This provides the visibility needed to determine which apps are unsanctioned. Conditional Access App Control is the correct feature because it uses a reverse proxy to enforce real-time access controls, blocking unsanctioned apps at the session level.
Variation 2. A security administrator needs to discover which cloud apps are being used in the organization and then block usage of unsanctioned apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps features must be configured to meet these requirements? (Select all that apply.)
hard- ✓ A.Cloud Discovery
- B.App Connectors
- ✓ C.Conditional Access App Control
- D.API connectors
Why A: Cloud Discovery (A) is correct because it analyzes traffic logs from your network to identify all cloud apps in use, providing visibility into sanctioned and unsanctioned apps. Conditional Access App Control (C) is correct because it enforces real-time access controls via a reverse proxy, allowing you to block unsanctioned apps as users attempt to access them.
Variation 3. A security administrator needs to block unsanctioned cloud apps in real time using a reverse proxy. Which two Microsoft Defender for Cloud Apps components must be configured?
medium- A.Cloud Discovery
- ✓ B.Conditional Access App Control
- C.App governance
- ✓ D.Session control policies
Why B: Conditional Access App Control (B) is the reverse proxy component in Microsoft Defender for Cloud Apps that enforces real-time session-level monitoring and control of cloud app access. Session control policies (D) are the specific policy objects that define the actions (e.g., block download, block access) applied through that reverse proxy. Together, they enable blocking unsanctioned cloud apps in real time by intercepting user traffic via the reverse proxy architecture.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.