How to Detect Anomalous User Behavior with Defender for Cloud Apps UEBA
Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?
Quick Answer
The answer is anomaly detection policies. This is the correct feature because Microsoft Defender for Cloud Apps uses User and Entity Behavior Analytics (UEBA) to establish a baseline of normal user activity and then triggers alerts when deviations occur, such as impossible travel or unusual data downloads. On the SC-900 exam, this question tests your understanding of how UEBA functions within the broader Microsoft 365 Defender suite, often appearing alongside questions about Cloud Discovery or app connectors as distractors. A common trap is confusing anomaly detection policies with Secure Score, which measures security posture, or Cloud Discovery, which identifies shadow IT. Remember the key distinction: anomaly detection policies are the engine for spotting behavioral anomalies, while other options serve different governance or visibility roles. A helpful memory tip is to think of “anomaly” as “abnormal activity” — if the question describes unusual user behavior, your answer is always the policy that detects it.
⚠ Common exam trap
Many candidates confuse 'Cloud Discovery' (which identifies shadow IT) with 'anomaly detection' (which focuses on user behavior), or they mistakenly think 'App connectors' are needed for behavioral monitoring, when in fact connectors enable data ingestion but not the behavioral analysis itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly detection policies
Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then trigger alerts for deviations, such as impossible travel, unusual data exfiltration, or risky sign-in patterns. This directly addresses the requirement to detect anomalous user behavior across cloud applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Anomaly detection policies
Why this is correct
Anomaly detection policies use UEBA to detect unusual user behavior.
- ✗
App connectors
Why it's wrong here
App connectors enable API integration but do not detect anomalies on their own.
- ✗
Secure Score
Why it's wrong here
Secure Score measures security posture, not user behavior.
- ✗
Cloud Discovery
Why it's wrong here
Cloud Discovery identifies shadow IT apps, not user behavior.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?
easy- ✓ A.Anomaly detection policy
- B.Activity policy
- C.App discovery policy
- D.Session policy
Why A: Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.
Variation 2. Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?
medium- A.A file policy
- B.A session policy
- C.An app permission policy
- ✓ D.An anomaly detection policy
Why D: An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user activities, such as access from a new IP address outside the organization's trusted IP range. This policy leverages machine learning to establish a baseline of normal behavior and triggers alerts when deviations occur, making it the correct choice for this scenario.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.