Enabling the Microsoft 365 connector and app governance so Defender for Cloud Apps feeds automatic attack disruption

SC-200 By islever Editorial Last updated

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Short answer

AC Automatic attack disruption needs the Microsoft 365 connector and App Governance enabled in Defender for Cloud Apps.

Question

You have a Microsoft 365 E5 subscription. You need to configure Microsoft Defender XDR automatic attack disruption to use signals generated by Microsoft Defender for Cloud Apps. Which two actions should you perform for Defender for Cloud Apps in the Microsoft Defender portal? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
  1. Enable the Microsoft 365 connector. Correct Answer
  2. Add a log collector for automatic log upload.
  3. Turn on app governance. Correct Answer
  4. Deploy Cloud Discovery user enrichment.
  5. From Information protection, enable file monitoring.

Key Takeaways

Automatic attack disruption that consumes Defender for Cloud Apps signals requires both the Microsoft 365 (Office 365) connector and App Governance to be enabled, which together expose the app/identity signals needed for disruption.

To let Microsoft Defender XDR automatic attack disruption use signals from Defender for Cloud Apps, you must enable the Microsoft 365 connector and turn on app governance for Defender for Cloud Apps — these are the documented prerequisites.

Common mistake: Picking Cloud Discovery user enrichment or file monitoring — those are Defender for Cloud Apps features but are not the documented prerequisites for feeding automatic attack disruption.

Expert Analysis

Why the Answer Is Correct

The Microsoft Defender XDR automatic attack disruption prerequisites for Defender for Cloud Apps state that you must enable the Microsoft 365 (Office 365) connector and turn on App Governance. These two actions make the Cloud Apps signals available to automatic attack disruption.

Why the Other Options Are Wrong

Deploying Cloud Discovery user enrichment (D) and turning on file monitoring (E) are useful Cloud Apps capabilities but are not the two prerequisites for automatic attack disruption. Adding a log collector for automatic log upload (B) is for discovery ingestion, not attack disruption signals.

Community Comment Notes

jamspurple and Blasty both cite the configure-attack-disruption documentation, confirming the answer is A (Microsoft 365 connector) and C (App Governance). a_kto_to's ChatGPT answer of C and D is incorrect.

Official Reference

https://learn.microsoft.com/en-us/defender-xdr/configure-attack-disruption

This link opens the official vendor documentation in a new tab.

Community Votes

AC
67%
CD
33%

67% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. a_kto_to 👍 1
    As per chatGTP: ✅ Final Answer: ✔ C. Turn on App Governance ✔ D. Deploy Cloud Discovery User Enrichment Would you like a guide on enabling these in Defender for Cloud Apps? 😊
  2. Blasty 👍 1
    Two actions must be performed: - Microsoft Office 365 connector - App Governance must be turned on https://learn.microsoft.com/en-us/defender-xdr/configure-attack-disruption
  3. jamspurple 👍 1
    A and C https://learn.microsoft.com/en-us/defender-xdr/configure-attack-disruption#microsoft-defender-for-cloud-apps-prerequisites

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide