SC-300 Certification Practice Question #156

Question

You have a Microsoft 365 E5 subscription.

You need to be able to create a Microsoft Defender for Cloud Apps session policy.

What should you do first?

Accepted Answer

A Defender for Cloud Apps session policy depends on Conditional Access App Control, which only works if a Microsoft Entra ID Conditional Access policy (with the "Use Conditional Access App Control" session control) exists to route traffic through the proxy. MS Learn's session-policy prerequisites state this explicitly: the policy needs a Microsoft Entra ID Conditional Access policy "which creates the permissions to control traffic." The Suggested Answer and Most Voted (10 votes) are both C, with a 5-👍 Highly Voted comment citing the same MS Learn page. The B ("App onboarding/maintenance") dissent is plausible but discounted because Microsoft Entra ID apps are automatically onboarded — manual onboarding is required only for non-Microsoft IdP apps, which this E5/Entra scenario does not mention. A and D are Cloud Discovery functions and don't gate session-policy creation.

More SC-300 practice questions