15.2 Defender for Cloud Apps Policies & Alerts

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

15.2 Defender for Cloud Apps Policies & Alerts

Key Takeaways Explain This Topic AI

Defender for Cloud Apps policy types include activity, anomaly detection (UEBA), file, Cloud Discovery, OAuth app, and session policies, each keyed to a different signal source

Activity and anomaly detection policies evaluate the activity log; file policies scan connected-app files for sensitive content and external sharing; Cloud Discovery policies evaluate discovered apps; OAuth app policies control third-party apps users consented to; session policies enforce real-time control via Conditional Access App Control

Every policy defines filters (user, IP, app, location, activity type), triggers (activity match, anomaly score, file label), and governance actions such as alert, block, require MFA, quarantine file, revoke OAuth app, revoke user sign-in sessions, sanction/unsanction app, or send to Power Automate

Alert severity drives triage priority in the Alerts queue, and each alert can be resolved, dismissed, or escalated with a governance action applied to the related user, file, or app

Last updated: August 2026

Policy Types in Defender for Cloud Apps

Policies are the engine that turns Defender for Cloud Apps telemetry into detections and automated responses. Each policy type is keyed to a different signal source, and MS-102 expects you to know which type applies to which scenario.

Policy type Signal source Typical use case

Activity policy Activity log events Detect mass download, admin privilege changes, sign-ins from risky locations

Anomaly detection policy UEBA / behavioral models Detect impossible travel, ransomware activity, suspicious inbox forwarding

File policy Files in connected apps Detect sensitive content shared externally, apply sensitivity labels, quarantine

Cloud Discovery policy Discovered apps from logs Detect new risky app used, unsanctioned app usage, top user of unsanctioned apps

OAuth app policy Third-party OAuth app grants Detect and revoke risky OAuth apps users consented to in Microsoft 365 or Google

Session policy Conditional Access App Control session Real-time block download, block upload, require MFA, restrict admin actions in session

Anatomy of a Policy

Every policy in Defender for Cloud Apps follows the same three-part structure: filters → triggers → governance actions .

Filters

Filters narrow the scope of activities, files, or apps the policy evaluates. Common filters include:

• User / user group — specific users, groups, or all users except administrators
• IP address / IP tag — corporate IP range, anonymous proxy, risky IP
• App — Microsoft 365, Salesforce, or any connected app
• Location — country/region derived from IP geolocation
• Activity type — logon, file download, admin role change, OAuth app grant
• Device — managed vs. unmanaged, device tag
• Triggers

A trigger defines when the policy fires:

Activity matches — a single activity or a count of activities within a time window (e.g., more than 50 downloads in 60 minutes)

Anomaly score — UEBA models assign a risk score; the policy fires when the score crosses a threshold

File label / sensitive info type — a Microsoft Purview sensitivity label or sensitive info type is detected on a file, or the file is shared externally

Discovered app risk score — a Cloud Discovery policy fires when a discovered app's risk score crosses a threshold or when a new app appears

Governance Actions

Governance actions define what Defender for Cloud Apps does when a policy fires. Available actions depend on the policy type and the connected app:

• Alert — create an alert with severity Low, Medium, or High
• Block — block the user, block the activity, or block the app (Cloud Discovery)
• Require MFA — require the user to re-authenticate with MFA (via Conditional Access App Control)
• Quarantine file — move a file to a quarantine location in SharePoint or OneDrive
• Revoke OAuth app — revoke a third-party OAuth app grant
• Revoke user sign-in sessions — force the user to sign in again across Microsoft 365
• Suspend user — suspend the user account in the connected app
• Sanction / unsanction app — mark a discovered app as sanctioned or unsanctioned
• Apply sensitivity label — apply a Microsoft Purview sensitivity label to a file
• Send to Power Automate — trigger a Power Automate playbook for custom response
• Notify user — send an email to the user or their manager
• Configuring a Sample Activity Policy

To create a policy that detects mass downloads in Microsoft 365:

In the Defender portal, go to Policies > Policy management > Create policy > Activity policy .

Set a name and severity (e.g., High).

Under Activities matching all of the following , add filters:

• App equals Microsoft 365
• Activity type equals Download

Under Activity count , set More than 50 within 60 minutes for the same user.

Under Governance actions , choose Alert and Require user to sign in again (revoke sessions).

Save the policy. It begins evaluating the activity log immediately.

Anomaly Detection (UEBA)

Anomaly detection policies use User and Entity Behavior Analytics (UEBA) to baseline normal behavior for each user and peer group, then flag deviations. Built-in anomaly detections include:

• Impossible travel — sign-ins from two geographically distant locations within an impossible time window
• Activity from anonymous IP address — sign-in from a Tor exit node or anonymizer
• Frequent false positive alert dismissal — a user keeps dismissing MFA prompts
• Ransomware activity — patterns consistent with ransomware file encryption
• Suspicious inbox forwarding — a new inbox rule that forwards all mail externally
• Unusual add-in use — suspicious Exchange add-in activity

Anomaly detections are on by default for connected apps but can be tuned by adjusting the sensitivity slider and excluding user groups (e.g., service accounts).

OAuth App Policies

Users in Microsoft 365 and Google Workspace can consent to third-party OAuth apps that gain access to their mail, files, and calendar. OAuth app policies let you:

• Detect apps with high-risk scopes (e.g., Mail.Read, Files.ReadWrite)
• Detect apps granted by many users
• Ban an app, which revokes existing grants and blocks future consent
• Approve an app, which allows consent

This is one of the most important CASB controls for stopping consent phishing.

Alert Triage

When a policy fires, an alert is created and surfaced in the Alerts queue. Each alert shows the policy name, severity, related user, related app, and the activities or files that triggered it. From the alert you can:

• View similar alerts to correlate
• Open the activity in the activity log

Apply a governance action — ban the app, revoke OAuth grant, quarantine the file, suspend the user, dismiss the alert as a false positive, or resolve it

Send to Power Automate for orchestrated response

Alert severity (Low, Medium, High) helps prioritize. High-severity alerts typically warrant immediate investigation; low-severity alerts may be auto-resolved by tuning the policy.