Design security operations, identity, and compliance capabilities →easyMultiple SelectObjective-mapped
Enable Microsoft Defender for Cloud Apps Monitoring
Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?
Quick Answer
The answer is enabling Conditional Access App Control and deploying app connectors. These two configurations are required to enable Microsoft Defender for Cloud Apps monitoring because app connectors establish API-based integrations with cloud applications like Office 365 or Salesforce, allowing the service to ingest activity logs, file metadata, and user sessions for threat detection, while Conditional Access App Control enforces real-time access policies to monitor and control user sessions. On the Microsoft Cybersecurity Architect exam, this tests your understanding of how Defender for Cloud Apps operates at both the data plane (via connectors) and the control plane (via session policies). A common trap is assuming that simply enabling the service in the portal is enough, but without both components, monitoring remains incomplete. Remember the mnemonic “Connect and Control”—connectors bring the data in, and Conditional Access App Control governs the user experience.
⚠ Common exam trap
Many candidates confuse prerequisites (like Microsoft Entra ID sync) with the actual enabling configurations, or they assume device compliance policies (Intune) are required for cloud app monitoring when they are only relevant for conditional access grant controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add app connectors for the cloud apps you want to monitor
A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add app connectors for the cloud apps you want to monitor
Why this is correct
App connectors enable API-based monitoring.
- ✗
Configure Microsoft Intune device compliance policies
Why it's wrong here
Intune policies are for device management.
- ✗
Deploy Azure Information Protection scanner
Why it's wrong here
Scanner is for on-premises data classification.
- ✗
Synchronize with Microsoft Entra ID
Why it's wrong here
Synchronization is automatic; not a configuration.
- ✓
Enable Conditional Access App Control
Why this is correct
App control allows real-time session monitoring.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization is deploying Microsoft Defender for Cloud Apps. Which THREE capabilities are included in Defender for Cloud Apps? (Select three.)
medium- ✓ A.Session controls
- ✓ B.App governance
- ✓ C.Cloud Discovery
- D.Data Loss Prevention (DLP) policies
- E.Conditional Access
Why A: Session controls are a core capability of Microsoft Defender for Cloud Apps, enabling real-time monitoring and control of user app sessions via reverse proxy integration. This allows administrators to enforce policies like blocking downloads or read-only access for sensitive data, leveraging Conditional Access App Control to intercept traffic to sanctioned SaaS apps.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.