Microsoft Defender for Cloud Apps Policies and Investigation – SC-200 Study Guide

Purpose of This Lesson

Microsoft Defender for Cloud Apps (Defender for Cloud Apps) helps security teams discover cloud application usage, assess application risk, enforce policies, and investigate user and file activity. For the SC-200 exam, the important skill is choosing the correct policy type and using activity information to determine whether behavior is normal, risky, or indicative of data loss or account compromise.

Key Concepts

Cloud app discovery and application risk

Defender for Cloud Apps can identify cloud applications used by people in the organization when the relevant cloud services, endpoints, or activity logs are connected. Discovery can reveal sanctioned services such as OneDrive and Salesforce as well as unsanctioned or previously unknown applications.

The Cloud App Catalog provides information about discovered applications, including categories and a Microsoft-assigned risk score. The score is based on factors such as compliance support, security practices, and other risk-related attributes. Use this information as an input to governance decisions rather than treating the score as an automatic allow or block decision.

Policy types

Defender for Cloud Apps policies are designed for different detection and control objectives:

Policy type	Primary purpose	Example use case
Activity policy	Detect or control specific user activities	Alert when a user performs a sensitive operation in a cloud service
Anomaly detection policy	Identify unusual behavior or activity patterns	A user who has never used a service uploads an unusually large volume of data
OAuth app policy	Govern third-party application authorization	Review or restrict a suspicious application requesting access to organizational data
Malware detection policy	Detect malware associated with cloud-stored files	Identify a malicious file uploaded to a connected cloud service
File policy	Inspect file activity and apply file-sharing or DLP-related controls	Detect files shared with personal email addresses
Access policy	Control access based on conditions such as location or session context	Restrict access from an unacceptable location
Session policy	Apply real-time controls while a user is connected	Monitor or control activities during an active cloud session
App discovery policy	Work with discovered applications and their governance status	Identify newly discovered applications requiring review
Cloud discovery anomaly detection	Analyze cloud application logs for abnormal usage	Detect a sudden, atypical data transfer to a cloud storage service

Policy types can be associated with risks such as access control, compliance, configuration, data loss prevention, privileged accounts, sharing, and threat detection.

File policies and templates

Policy templates provide a faster starting point for common scenarios. A file policy template for files shared with personal email addresses can be used to identify potentially unauthorized external sharing.

A file policy can commonly be narrowed by:

• The personal email address patterns or domains to match
• All files, selected folders, or excluded folders
• File owners or selected user groups
• Data classification information, such as sensitivity labels, when the data classification service is used
• Alerting behavior and notification recipients
• Remediation actions for supported services, such as notifying users, removing external sharing, making a file private, or moving content to the recycle bin

Remediation settings should be selected carefully. A broad policy combined with automatic sharing removal can affect legitimate collaboration and should normally be validated in audit or alert-only mode first.

Alert limits and notifications

Policies can generate alerts and email notifications. A daily alert limit helps prevent a single noisy condition from overwhelming analysts and mailboxes. The limit reduces alert volume; it does not replace tuning the policy or investigating the underlying behavior.

Microsoft Security Operations Context

Defender for Cloud Apps contributes cloud application activity and governance data to the broader Microsoft security operations workflow. An analyst may use it to:

1. Discover an application that is not in the approved software inventory.
2. Review the application’s catalog risk and compliance information.
3. Determine whether a policy detected abnormal access, file sharing, malware, or OAuth activity.
4. Inspect the activity log for the user, IP address, time, operating system, and other available context.
5. Compare the event with identity, endpoint, email, and cloud activity from the rest of the Microsoft security stack.
6. Contain the risk, document the decision, and escalate to identity, data protection, cloud platform, or incident response teams as appropriate.

The activity log is an investigation starting point. A single login or file event is not automatically a security incident. Analysts should establish a baseline, validate the user’s expected location and work pattern, and correlate the event with other evidence.

Exam-Relevant Takeaways

• Use the Cloud App Catalog to review discovered applications and their risk information.
• Choose a policy based on the activity or risk being detected, not merely on the name of the cloud service.
• Use a file policy for file-related conditions such as sharing with personal email addresses.
• Use anomaly detection when the requirement is to identify unusual behavior relative to an established pattern.
• Use access policies for access conditions and session policies for controls applied during an active session.
• OAuth app policies address third-party application authorization and consent behavior.
• Templates accelerate policy creation, but the resulting filters, scope, alerts, and remediation actions must still be reviewed.
• The activity log provides investigation details including event time, user, source IP, and device or operating system context when available.
• Automatic remediation can reduce exposure but may disrupt business workflows. Validate scope and permissions before enabling it.
• Alert limits reduce repetitive noise; they are not a substitute for good policy design or incident triage.

Tool / Feature Decision Guide

Requirement	Best starting point	Why
Find cloud services being used in the organization	Cloud discovery / app discovery	Reveals application usage, including potentially unsanctioned services
Assess whether a discovered application is acceptable	Cloud App Catalog	Provides application risk and compliance-related details
Detect a user sharing files with personal email	File policy	Matches file activity and can support notification or sharing remediation
Detect a sudden unusual volume of activity	Anomaly detection	Compares activity with expected behavior
Govern a third-party app requesting access	OAuth app policy	Focuses on application authorization and consent
Detect malicious content in cloud files	Malware detection policy	Focuses on malware associated with file activity
Restrict or evaluate sign-in conditions	Access policy	Addresses access context such as location or session conditions
Monitor or control actions during a live connection	Session policy	Applies real-time session controls
Review what actually happened	Activity log	Provides event-level evidence for triage and investigation

Common Exam Traps

• Confusing file policy with access policy: File sharing and file activity belong to file-policy scenarios; sign-in conditions belong to access-policy scenarios.
• Confusing discovery with enforcement: Discovering an application does not automatically block it. A separate policy or governance decision is required.
• Treating a catalog score as a verdict: A risk score helps evaluate an application but does not replace organizational approval criteria.
• Using anomaly detection for every event: Anomaly policies are for behavior that deviates from a baseline. A precise file-sharing condition is better handled by a file policy.
• Ignoring policy scope: A policy may apply to all files or users, selected folders, or selected groups. Scope is often the deciding detail in a scenario.
• Overlooking remediation side effects: Removing external sharing or making files private can interrupt legitimate business activity.
• Assuming an alert limit fixes noisy detections: Limits control the number of generated alerts; they do not correct an overly broad or inaccurate policy.

Real-World SOC Analyst Notes

• Start new detections in alert-only or audit-oriented mode when possible. Measure volume and false positives before enabling disruptive remediation.
• Preserve the original event details, including timestamps, user identity, source IP, application, file or activity context, and policy name.
• Validate unusual travel or location alerts against VPN use, corporate proxies, mobile networks, and approved travel before disabling an account.
• Do not use anonymizing services such as Tor in production or casually in a tenant to generate test detections. Use an approved test account, controlled test data, and documented test infrastructure instead.
• Confirm that the connected service and relevant logs provide sufficient coverage. A quiet activity log may indicate limited telemetry rather than an absence of risky activity.
• Use group and folder scoping to reduce unintended impact, especially when a policy can remove external sharing or modify file access.
• Coordinate with data owners, identity administrators, and application owners before taking action on legitimate collaboration or OAuth consent.
• Treat alert thresholds and daily limits as operational controls. Review trends periodically so important events are not hidden by suppression or excessive noise.

Quick Reference Summary

• Cloud App Catalog: Review discovered applications and their risk or compliance information.
• Discovery: Identify cloud applications in use across the organization.
• File policy: Detect and respond to file activity, including risky sharing.
• Anomaly detection: Identify behavior that deviates from normal patterns.
• OAuth app policy: Govern third-party application authorization.
• Access policy: Address access conditions such as location.
• Session policy: Apply controls during an active cloud session.
• Activity log: Investigate users, timestamps, IP addresses, operating systems, and related event context.
• Safe rollout: Validate scope, alert volume, permissions, and remediation impact before enforcement.

Flashcards

Q: An organization needs to identify cloud applications that users are accessing, including services not yet approved by IT. Which Defender for Cloud Apps capability should be used?
A: Use cloud discovery or app discovery. It surfaces cloud application usage so the SOC and governance teams can assess and classify the services.

Q: When should an analyst use a file policy instead of an anomaly detection policy?
A: Use a file policy when the condition is specific to file activity, such as sharing with a personal email address. Use anomaly detection when the central requirement is behavior that deviates from a normal baseline.

Q: What information does the Cloud App Catalog provide during application review?
A: It provides application details such as category, risk scoring, and compliance-related attributes. The score supports risk assessment but is not by itself an organizational allow or deny decision.

Q: A user shares a corporate file with a personal email address. Which policy type is the most direct match?
A: A file policy is the direct match because it evaluates file activity and sharing conditions. A template can accelerate creation, but its matching criteria and scope must be validated.

Q: What is the distinction between an access policy and a session policy?
A: An access policy evaluates access conditions, such as where a login originates. A session policy applies monitoring or control while the user is actively connected.

Q: Which policy type addresses a third-party application requesting authorization to organizational data?
A: An OAuth app policy. It is intended to govern application authorization and consent activity.

Q: A user who has never used a cloud storage service suddenly uploads an exceptionally large amount of data. Which detection approach is most appropriate?
A: Anomaly detection is the best starting point because the concern is a significant deviation from the user’s normal behavior. The analyst should then validate the user, destination, and business context.

Q: What is the purpose of a policy template in Defender for Cloud Apps?
A: A template supplies a preconfigured starting point for a common scenario. It does not eliminate the need to review filters, users, folders, classification settings, notifications, and remediation actions.

Q: Why might a policy include a daily alert limit?
A: It limits repetitive alert volume so analysts and mailboxes are not overwhelmed by the same condition. It should be combined with policy tuning because it does not remove the underlying false positive.

Q: An analyst needs to verify the time, user, source IP, and operating system associated with a cloud activity. Where should the investigation begin?
A: Begin in the Defender for Cloud Apps activity log. Use the event details as evidence and correlate them with identity, endpoint, and other cloud telemetry.

Q: What is the operational risk of enabling automatic removal of external file sharing on a broad policy?
A: It can disrupt legitimate collaboration and alter access for many users. Validate the policy with controlled scope and alert-only testing before enabling tenant-wide remediation.

Q: Does discovering an application in Defender for Cloud Apps automatically block it?
A: No. Discovery provides visibility; enforcement requires an appropriate policy or governance action.

Q: Why should an unusual location or travel alert not immediately be treated as proof of account compromise?
A: VPNs, proxies, mobile networks, and legitimate travel can change the apparent source location. Confirm the activity with the user and correlate identity and endpoint evidence before containment.

Practice Questions

Question 1

A SOC team wants to detect files in OneDrive or SharePoint that are shared with addresses outside the organization’s approved domains. Which approach should the analyst choose?

• A. Create an access policy based on sign-in location
• B. Create a file policy using a file-sharing template and external address filters
• C. Create an OAuth app policy for the file owner
• D. Create a session policy that monitors connection duration

Correct answer: B

A file policy directly evaluates file activity and can use a template for sharing with personal or external email addresses. The other choices address access context, application authorization, or live sessions rather than the file-sharing condition.

Question 2

A discovered cloud application is being used by several employees. Before deciding whether it should be approved, the analyst needs information about its security and compliance posture. What should the analyst review first?

• A. The Cloud App Catalog entry and its risk information
• B. The user’s session duration only
• C. The daily alert limit for file policies
• D. The operating system from the activity log

Correct answer: A

The Cloud App Catalog provides application risk and compliance-related information that supports a governance decision. Activity details may be useful later, but they do not provide the application-level assessment requested.

Question 3

A user has no history of using a particular cloud storage service, then uploads an unusually large volume of data in a short period. Which policy type best fits the initial detection requirement?

• A. File policy for a fixed personal email address
• B. OAuth app policy
• C. Anomaly detection policy
• D. Access policy for a known office location

Correct answer: C

The defining characteristic is behavior that deviates from the user’s normal pattern. Anomaly detection is designed for this scenario; the analyst can then investigate the specific files, destination, and user context.

Question 4

An organization wants to reduce the risk of a new file-sharing policy disrupting legitimate collaboration. What should the SOC do first?

• A. Apply the policy to every user and immediately remove external sharing
• B. Set the daily alert limit to zero
• C. Test the policy with limited scope and alerting before enabling remediation
• D. Ignore policy matches until users report access problems

Correct answer: C

Controlled testing reveals false positives and expected business use before destructive or disruptive actions are enabled. Alert limits manage volume but do not validate whether the policy is safe.

Question 5

An investigation requires reviewing a cloud login’s timestamp, user, source IP address, and operating system. Which Defender for Cloud Apps feature should the analyst use?

• A. Activity log
• B. Cloud App Catalog
• C. Policy template gallery
• D. OAuth app policy editor

Correct answer: A

The activity log contains event-level information used for investigation, including user and connection context when available. The other features are intended for application assessment or policy configuration.