SC-300 Certification Practice Question #213

Question

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.

You need to enable Microsoft Defender for Cloud Apps session control for Site1.

Which type of policy should you create first?

Accepted Answer

Enabling Defender for Cloud Apps session control is a two-stage flow, and the question asks which policy comes *first*. Conditional Access App Control is the reverse-proxy mechanism: you must first create a Microsoft Entra Conditional Access policy targeting SharePoint Online with **Session > Use Conditional Access App Control** so that session traffic is routed (proxied) to Defender for Cloud Apps. Only then can a Defender for Cloud Apps session policy be authored and applied. MS Learn states this ordering explicitly, the Suggested Answer is D, and the top community comment (3 👍) walks through the exact same steps, so confidence is high.

More SC-300 practice questions