What Should You Do First for App1 Access Policy in Defender for Cloud Apps?

MS-102 By islever Editorial Last updated

Short answer

A Deploy Conditional Access App Control to App1 before creating the Defender for Cloud Apps access policy.

Question

You have a Microsoft 365 E5 subscription and use Microsoft Defender for Cloud Apps. You register a cloud app named App1 in Microsoft Entra ID. You need to create an access policy for App1. What should you do first?
  1. Deploy Conditional Access App Control to App1. Correct Answer
  2. Create an app tag for App1.
  3. Add a security information and event management (SIEM) agent to Defender for Cloud Apps.
  4. Configure an app connector to Defender for Cloud Apps.

Key Takeaways

The exam tests the prerequisite for a Defender for Cloud Apps access policy, and the common trap is confusing API-based app connectors with session-control onboarding via Conditional Access App Control.

Microsoft Defender for Cloud Apps access policies require Conditional Access App Control, not an API app connector. This page establishes that deploying Conditional Access App Control to App1 is the correct first step for an MS-102 access policy.

Common mistake: Most candidates choose D (configure an app connector) because app connectors are the usual first step for API visibility, but they are not required for real-time access policies.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Cloud Apps access policies are real-time session policies that depend on Conditional Access App Control (CAAC). When you register App1 in Microsoft Entra ID, you must deploy CAAC to it so that authentication traffic can be proxied and evaluated by Defender for Cloud Apps. Only after CAAC is deployed can you create an access policy that blocks or allows sessions based on conditions. The app connector path is for API-based visibility and does not provide the session interception required for access policies. Therefore, deploying CAAC is the prerequisite first step.

Why the Other Options Are Wrong

Creating an app tag (B) is used for filtering and grouping apps after onboarding, not for enabling access policies. Adding a SIEM agent (C) integrates Defender for Cloud Apps alerts with a SIEM, which is unrelated to creating an access policy for a specific app. Configuring an app connector (D) is the correct first step for activity and file policies that rely on API data, but it does not enable real-time session control; an access policy needs CAAC. Because the question specifically asks for an access policy, D is a distractor that many candidates select by habit.

Community Comment Notes

The comments show a split: the vote majority picked D, but deeper explanations favor A. wafferrr wrote that app connectors are "not required for access policies," pointing to the real prerequisite. JohnDoe47 described registering an app in Entra, adding a Conditional Access App Control policy, and then creating an access policy with "Automatic Entra ID onboarding" — demonstrating that no app connector was needed. GetEsn shared the official get-started link, which reinforces the CAAC onboarding path. These learner notes support the conclusion that Conditional Access App Control is the first step.

Official Reference

https://learn.microsoft.com/en-us/defender-cloud-apps/get-started

This link opens the official vendor documentation in a new tab.

Exam Strategy

For MS-102, distinguish between API app connectors (for activity and file policies) and Conditional Access App Control (for access and session policies). If the question mentions an app registered in Entra ID and an access policy, look for Conditional Access App Control deployment as the prerequisite.

Frequently Asked Questions

Why is configuring an app connector not the first step for an App1 access policy?

App connectors provide API-based activity and file visibility; access policies need real-time session control, which requires Conditional Access App Control instead.

Does registering App1 in Microsoft Entra ID automatically onboard it to Defender for Cloud Apps?

No, Entra ID registration alone is not enough; you must deploy Conditional Access App Control to App1 before creating an access policy.

More MS-102 FAQ →

Community Votes

D
73%
A
27%

73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. GetEsn 👍 5 Answered D
    https://learn.microsoft.com/en-us/defender-cloud-apps/get-started
  2. Vince_MCT 👍 3 Answered D
    To create an access policy for a registered app like App1 in Microsoft Defender for Cloud Apps, you need to first establish integration between the app and Defender for Cloud Apps. This is achieved by configuring an app connector. App connector: This enables Microsoft Defender for Cloud Apps to monitor and manage the app's activities. It integrates the app with Defender for Cloud Apps to provide visibility and enforce policies. After the app connector is configured, you can proceed to create access policies or other governance actions.
  3. hwoccurrence 👍 3 Answered D
    When Defender for Cloud Apps manages a SaaS application, the first step is to establish direct integration so that Defender for Cloud Apps can see activities and apply policies. Concretely, this means configuring an app connector for the cloud app. Therefore, the correct first step is: D. Configure an app connector to Defender for Cloud Apps. Only after the app is connected and Defender for Cloud Apps has visibility into user activities can you create and enforce an access policy for that app.
  4. JohnDoe47 👍 3
    I registered "Demo App" in Entra and added a Conditional Access App Control Policy targeting "Demo App". After that, I added an Access Policy with Activity: App > Automatic Entra ID onboarding > equals > "Demo App" --> The Apps in Entra are automatically onboarded. We do not need to connect an app (answer D)
  5. wafferrr 👍 1 Answered A
    App connectors provide API-based visibility and control over cloud apps, but they are not required for access policies.
Show 2 more comments
  1. Xive 👍 2 Answered A
    A is correct
  2. HelloItsSam 👍 1 Answered A
    Given answer is correct!

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which passwordless method works on Windows, Android, and iOS?

S-grade

How Do You Monitor Mailbox Activities in Defender for Cloud Apps?

S-grade

Which components configure a Defender for Cloud Apps log collector?

S-grade

How to Configure a Custom Phishing Link in Attack Simulation Training?

S-grade

Practice All MS-102 Questions

Access 111 questions with complete answers and detailed explanations.

View Full MS-102 Practice Test →

← Back to MS-102 Study Guide