Managing OAuth App Policies in Defender for Cloud Apps
A company uses Microsoft Defender for Cloud Apps. The security team discovers that a user has granted a third-party OAuth app with 'read all mail' and 'send mail as user' permissions. They want to automatically revoke the authorization for this risky app and block similar apps in the future. Which Defender for Cloud Apps feature should they use?
Quick Answer
The answer is OAuth app policies. This is the correct feature because it specifically governs OAuth consent grants, enabling security teams to automatically revoke risky permissions—such as 'read all mail' and 'send mail as user'—and block similar apps in the future based on risk level. On the SC-900 exam, this question tests your understanding of how Defender for Cloud Apps enforces automated governance actions for third-party app permissions, often appearing as a scenario where you must distinguish OAuth app policies from other features like Conditional Access or Cloud Discovery. A common trap is confusing OAuth app policies with app governance in Microsoft 365 Defender, but remember: OAuth app policies are the dedicated tool within Defender for Cloud Apps for revoking risky app permissions and blocking future consent grants. Memory tip: think "OAuth = consent control" to link the policy name directly to the action of revoking user-granted permissions.
⚠ Common exam trap
A common mix-up: candidates confuse App Discovery/Cloud Discovery (which identify unmanaged cloud app usage) with OAuth app policies (which specifically govern third-party app permissions and consent grants).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth app policies
OAuth app policies in Microsoft Defender for Cloud Apps allow security teams to automatically revoke permissions for risky third-party OAuth apps and block future similar apps. This feature specifically governs OAuth consent grants, such as 'read all mail' and 'send mail as user', by enabling automated governance actions like revoking permissions and blocking the app based on risk level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
App Discovery
Why it's wrong here
App Discovery is for identifying cloud apps used in the environment, not for managing OAuth permissions.
- ✗
Conditional Access App Control
Why it's wrong here
Conditional Access App Control enforces session policies (e.g., block download) during a user session, not OAuth app governance.
- ✓
OAuth app policies
Why this is correct
Correct. OAuth app policies allow you to manage and revoke permissions for OAuth apps and set automatic governance actions.
- ✗
Cloud Discovery
Why it's wrong here
Cloud Discovery analyzes network traffic to identify cloud apps and usage, not to manage OAuth app permissions.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Salesforce and Box as cloud apps. The security team discovers that a third-party OAuth app with excessive permissions was granted access to Salesforce data by a user. They want a solution that can detect such risky OAuth apps and automatically revoke their permissions based on policy. Which Microsoft security solution provides this capability?
hard- ✓ A.Microsoft Defender for Cloud Apps
- B.Microsoft Defender for Endpoint
- C.Microsoft Defender for Office 365
- D.Microsoft Sentinel
Why A: Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides visibility into third-party OAuth apps connected to cloud services like Salesforce and Box. It can detect OAuth apps with excessive permissions and automatically revoke them based on conditional access or app governance policies, making it the correct solution for this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.