Microsoft 365 Administrator Expert MS-102 Practice Question

Marking the discovered app as Unsanctioned automatically tags it as disallowed. When Microsoft Defender for Cloud Apps is integrated with Microsoft Defender for Endpoint and App control for shadow IT (Enforce app access) is enabled, Defender for Endpoint distributes the associated domains to endpoint devices, where Network Protection blocks access-no firewall or proxy changes are required.

Creating an Activity policy with a Suspend-user governance action only applies to API-connected SaaS apps and does not prevent users from reaching the service. Adding the app to a continuous report and exporting a firewall block script requires separate firewall updates, which the scenario seeks to avoid. An Anomaly detection policy merely raises alerts and takes no blocking action. Therefore, tagging the app as Unsanctioned is the most direct and effective response.