Microsoft Security Operations Analyst Associate SC-200 Practice Question

The Revoke app action in Microsoft Defender for Cloud Apps invalidates the application's existing OAuth refresh and access tokens in Microsoft Entra ID. This immediately blocks any further access to Microsoft 365 data by that app while preserving the application's entry in the OAuth apps list, allowing analysts to keep investigating its properties, users, and activity history.

The Delete app action permanently removes the record from Defender for Cloud Apps and therefore is not appropriate when you still need to investigate it. Unsanction is used for discovered SaaS applications and does not affect OAuth tokens that have already been granted. Disable user targets a user account rather than the risky application itself, so it does not directly stop the OAuth app from accessing data granted by other users.