How to Block Downloads from Unmanaged Devices with Microsoft Defender for Cloud Apps
A company uses Microsoft 365 and sanctioned cloud apps like Salesforce and Box. The security team wants to prevent users from downloading sensitive documents from these apps when accessing from unmanaged personal devices, while still allowing read-only access. They need real-time session monitoring and control. Which Microsoft security solution should they use?
Quick Answer
The answer is Microsoft Defender for Cloud Apps, specifically its Conditional Access App Control feature, which provides the real-time session monitoring and control needed to block downloads from unmanaged devices while allowing read-only access. This solution works by intercepting user sessions to sanctioned cloud apps like Salesforce and Box, inspecting device compliance signals, and dynamically enforcing policies—such as preventing file downloads or restricting sensitive data access—without disrupting the user’s ability to view content. On the SC-900 exam, this scenario tests your understanding of how Microsoft’s security solutions map to specific use cases, often appearing as a scenario-based question where you must distinguish Defender for Cloud Apps from tools like Microsoft Intune or Azure AD Conditional Access. A common trap is choosing Intune for device management, but remember that session-level control for unmanaged devices is the hallmark of Defender for Cloud Apps. Memory tip: think “session control stops the download, not the device.”
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming that Office 365 covers all cloud app security, but Defender for Office 365 is limited to Microsoft 365 services and cannot enforce session policies on third-party SaaS apps like Salesforce or Box.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps provides real-time session monitoring and control via its Conditional Access App Control feature. This allows administrators to enforce policies that block downloads or restrict access to sensitive data based on device compliance, such as blocking downloads from unmanaged personal devices while permitting read-only access. The solution integrates with sanctioned cloud apps like Salesforce and Box to apply these controls at the session level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Defender for Office 365 protects email, Teams, and SharePoint from threats like phishing and malware. It does not provide real-time session control for third-party cloud apps like Salesforce or Box.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Defender for Cloud Apps can enforce session policies via Conditional Access App Control, allowing granular control over actions like download, upload, and copy based on user, device, and data sensitivity.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Defender for Identity monitors on-premises Active Directory for identity-based attacks such as lateral movement and privilege escalation. It does not provide session control for cloud apps.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Defender for Endpoint protects endpoints (workstations, servers) from malware and advanced threats. It does not offer real-time session control for SaaS applications.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Cloud Apps
Defender for Cloud Apps is a Microsoft cloud access security broker (CASB) that helps you discover, protect, and govern your cloud applications and data across multiple cloud environments.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization is deploying Microsoft Defender for Cloud Apps to protect against cloud app threats. You need to ensure that users are prompted for authentication when accessing a sanctioned cloud app from an unmanaged device. Which policy type should you configure?
medium- A.Activity policy
- B.Access policy
- C.Anomaly detection policy
- ✓ D.Session policy
Why D: A session policy in Microsoft Defender for Cloud Apps can enforce real-time controls during a session, such as prompting for authentication when a user accesses a sanctioned cloud app from an unmanaged device. Session policies use Conditional Access App Control to intercept access and require additional authentication based on device state, location, or other conditions. Access policies (option B) are used for blocking or allowing access based on criteria like device compliance, but they do not typically prompt for additional authentication; that is a function of session policies.
Variation 2. Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?
medium- A.Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.
- B.Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.
- C.Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.
- ✓ D.Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.
Why D: You need to use a Conditional Access policy with the 'Require session control' grant, targeting 'All cloud apps' and 'Unmanaged devices' as conditions. This integrates with Microsoft Defender for Cloud Apps to enforce additional authentication (via Microsoft Entra ID) and enable session monitoring, such as real-time activity logging and download blocking, for the sanctioned app when accessed from unmanaged devices.
Variation 3. Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?
medium- A.Configure a file policy
- B.Configure an access policy
- C.Configure an app permission policy
- ✓ D.Configure a session policy
Why D: Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on risk level. When a user is flagged as high risk, a session policy can be configured to automatically block anomalous file downloads from SharePoint by intercepting the session and applying actions such as block, allow, or restrict. This is the correct choice because it directly addresses the need to prevent the specific activity in real time.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.