Microsoft 365 Administrator Expert MS-102 Practice Question

For Microsoft 365 services, Microsoft Defender for Cloud Apps uses an app connector that relies on the Office 365 Management Activity API and on Microsoft 365 audit logging. Adding the Microsoft 365 app connector from the MDCA Connectors page establishes an OAuth-based connection that lets MDCA pull audit events, file metadata, DLP information, and sharing settings from SharePoint Online, OneDrive, Exchange Online, and Microsoft Teams. Without this connector, MDCA can only see data provided through other integrations such as Cloud Discovery or Defender for Endpoint but cannot ingest the rich, continuous telemetry required for policies and investigations.

The other options do not enable the necessary back-end connection:

• Enabling Cloud Discovery collects traffic logs from endpoints or firewalls but does not pull audit events directly from Microsoft 365 services.
• Turning on Continuous reports in Defender for Endpoint only forwards endpoint alerts and Cloud Discovery data, not SharePoint or Exchange audit logs.
• Publishing sensitivity labels is a Microsoft Purview Information Protection task and is unrelated to MDCA data ingestion.