How to Track Audited Cloud Discovery Apps in Defender for Cloud Apps?

Why the Answer Is Correct

Microsoft Defender for Cloud Apps supports custom app tags as reusable labels that are attached to apps discovered by Cloud Discovery, and the Cloud app catalog can then filter and group apps by those tags. To track an audit, you create a tag such as "Audited", apply it to every app that has been reviewed, and the resulting list of audited apps is displayed directly in the catalog (and in discovered-app queries that filter on the tag). This is exactly the requirement: persistent, catalog-visible tracking of audit status. The community position was unanimous — one learner wrote that "Custom tags can be used to denote the status of apps, including whether they have been audited", and another shared the discovered-app-queries documentation to support tag-based filtering. The source key's E is therefore correct on the merits, not just on vote count.

Why the Other Options Are Wrong

Defining each app as a critical asset (A) is a prioritization signal: criticality tells risk scoring and dashboards which SaaS apps matter most to the business, but it does not record who audited them or expose an "audited" view. Conditional Access App Control (B) is a session proxy that applies real-time access and session policies to sanctioned apps; it neither tags discovered apps nor produces an audit list in the catalog. App governance (C) focuses on OAuth app behavior, permissions and policy alerts for connected apps — it is not a labeling mechanism for Cloud Discovery results. A Cloud Discovery snapshot report (D) is a point-in-time export of discovered apps, traffic and usage; it can be shared with auditors, but it stores no state on the app objects, so the catalog cannot later display which apps were audited.

Community Comment Notes

All recorded learners selected E, so the community consensus and the source key agree here. The most detailed voter explained that tags categorize and track Cloud Discovery apps, noting that they can denote whether an app has been audited, which matches the exam's word "track". Another learner, GetEsn, posted the Microsoft Learn page on discovered-app queries without further explanation, which is the mechanism you would use to list tagged apps programmatically. Preeb added only a one-line confirmation that the answer is E, consistent with the tag-based reasoning above.