Microsoft Security Operations Analyst Associate SC-200 Practice Question

To stop file downloads from SharePoint Online when users are on unmanaged devices, you must inspect and control the session in real time. In Microsoft Defender for Cloud Apps, this is done with a Session policy. When you create a Session policy for SharePoint Online that applies only to sessions from unmanaged devices, you can choose the Block download (or Block download with DLP inspection) control. This prevents the file from being downloaded while still permitting in-browser viewing.

File policies work on files already stored in cloud apps and apply governance actions such as quarantine or encryption; they do not affect real-time download attempts. Activity policies generate alerts based on user actions but cannot directly block downloads. Anomaly detection policies are designed to discover suspicious behaviors (for example, impossible travel) rather than enforce granular controls. Therefore, configuring a Session policy that uses the Block download control is the only option that meets the stated requirement.