Microsoft Defender for Cloud Apps Session Controls
A company uses a third-party SaaS project management application. The security team wants to monitor and control user sessions when employees access the application from personal, unmanaged devices. Specifically, they want to block the download of files to local drives and display a warning message to the user if they attempt to download. Which Microsoft security solution should they deploy?
Quick Answer
The answer is Microsoft Defender for Cloud Apps. This is correct because it offers session controls through Conditional Access App Control, which proxies the SaaS application traffic to enforce real-time policies. For the scenario described, the security team can configure a session policy to block file downloads to local drives on unmanaged devices and display a custom warning message, all without modifying the third-party application itself. On the SC-900 exam, this tests your understanding of how Microsoft’s security solutions map to specific use cases—here, distinguishing Defender for Cloud Apps from Microsoft Entra ID Conditional Access, which handles access decisions but not granular in-app session monitoring. A common trap is confusing it with Microsoft Purview, which focuses on data classification and compliance rather than real-time session control. Memory tip: think “session proxy” for Defender for Cloud Apps—it sits between the user and the app to watch and block actions like downloads.
⚠ Common exam trap
Many exam-takers confuse Microsoft Defender for Cloud Apps with Microsoft Defender for Office 365, assuming all SaaS app protection falls under Office 365, but Defender for Cloud Apps is the cross-SaaS session control solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is the correct solution because it provides session-level controls via Conditional Access App Control. This allows the security team to monitor and control user sessions in real-time, including blocking file downloads to unmanaged devices and displaying custom warning messages, by proxying the SaaS application traffic through Defender for Cloud Apps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Correct. Defender for Cloud Apps with Conditional Access App Control provides session-level monitoring and control for SaaS apps, enabling actions like blocking downloads.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Incorrect. Defender for Endpoint provides endpoint detection and response, but does not offer session-level controls for third-party SaaS applications.
When this WOULD be correct
An exam scenario where a company needs to detect, investigate, and respond to advanced threats on endpoints (e.g., malware, ransomware) and requires endpoint detection and response (EDR) capabilities would make Defender for Endpoint the correct answer.
- ✗
Microsoft Defender for Office 365
Why it's wrong here
Incorrect. Defender for Office 365 protects email and collaboration workloads (Exchange, SharePoint, Teams), not general third-party SaaS applications.
When this WOULD be correct
A company wants to protect against malicious links and attachments in emails and block zero-day threats in Office 365 apps. Deploying Microsoft Defender for Office 365 would be correct.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Incorrect. Defender for Identity monitors on-premises Active Directory for identity-based attacks, not cloud SaaS app sessions.
When this WOULD be correct
An exam question describing a scenario where the security team needs to monitor and protect on-premises Active Directory user accounts and detect identity-based attacks (e.g., pass-the-hash, kerberoasting) would make Defender for Identity the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Defender for Cloud AppsCorrect answer▾
Why this is correct
Correct. Defender for Cloud Apps with Conditional Access App Control provides session-level monitoring and control for SaaS apps, enabling actions like blocking downloads.
✗Microsoft Defender for EndpointWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Endpoint focuses on endpoint protection (antivirus, EDR) and does not provide session-level control or conditional access policies for SaaS applications like blocking downloads from unmanaged devices.
★ When this WOULD be the correct answer
An exam scenario where a company needs to detect, investigate, and respond to advanced threats on endpoints (e.g., malware, ransomware) and requires endpoint detection and response (EDR) capabilities would make Defender for Endpoint the correct answer.
Why candidates choose this
Candidates may confuse endpoint security with cloud app security, assuming that controlling user sessions on personal devices falls under endpoint protection rather than cloud access security broker (CASB) functionality.
✗Microsoft Defender for Office 365Wrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange, SharePoint, and Teams, not on monitoring and controlling user sessions for third-party SaaS applications accessed from personal devices.
★ When this WOULD be the correct answer
A company wants to protect against malicious links and attachments in emails and block zero-day threats in Office 365 apps. Deploying Microsoft Defender for Office 365 would be correct.
Why candidates choose this
Candidates may confuse SaaS application security with Office 365 security, assuming that all cloud app protection falls under Office 365, or they may think the warning message feature is part of Office 365's data loss prevention capabilities.
✗Microsoft Defender for IdentityWrong answer — click to see why▾
Why this is wrong here
Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on controlling user sessions or file downloads in third-party SaaS applications.
★ When this WOULD be the correct answer
An exam question describing a scenario where the security team needs to monitor and protect on-premises Active Directory user accounts and detect identity-based attacks (e.g., pass-the-hash, kerberoasting) would make Defender for Identity the correct answer.
Why candidates choose this
Candidates may confuse identity protection with cloud app session control, assuming that monitoring user sessions implies an identity-focused solution, but Defender for Identity does not provide conditional access or session policies for SaaS apps.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?
hard- ✓ A.Microsoft Defender for Cloud Apps
- B.Microsoft 365 Defender
- C.Microsoft Sentinel
- D.Microsoft Defender for Endpoint
Why A: Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Azure AD Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.