Connecting the Microsoft 365 app connector to enrich Cloud Discovery usernames with Entra ID UPNs

SC-200 By islever Editorial Last updated

Short answer

B Connecting the Microsoft 365 app connector is the prerequisite for enriching Cloud Discovery usernames with Entra ID UPNs.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps and has Cloud Discovery enabled. You need to enrich the Cloud Discovery data. The solution must ensure that usernames in the Cloud Discovery traffic logs are associated with the user principal name (UPN) of the corresponding Microsoft Entra ID user accounts. What should you do first?
  1. From Conditional Access App Control, configure User monitoring.
  2. Create a Microsoft 365 app connector. Correct Answer
  3. Enable automatic redirection to Microsoft 365 Defender.
  4. Create an Azure app connector.

Key Takeaways

Cloud Discovery AAD/Entra enrichment requires the Microsoft 365 (formerly Office 365) app connector to be connected before usernames in traffic logs can be resolved to Entra ID UPNs.

To enrich Microsoft Defender for Cloud Apps Cloud Discovery data so discovered usernames map to Microsoft Entra ID UPNs, you must first connect the Microsoft 365 app connector, which is the prerequisite for Entra ID (Azure AD) enrichment of Cloud Discovery.

Common mistake: Choosing Conditional Access App Control user monitoring or an Azure app connector — neither is the prerequisite for resolving Cloud Discovery usernames to Entra ID UPNs; the Microsoft 365 app connector is.

Expert Analysis

Why the Answer Is Correct

Defender for Cloud Apps Cloud Discovery can enrich discovered usernames with their Microsoft Entra ID (Azure AD) UPNs, but the documented prerequisite is to connect the Microsoft 365 app connector first; without it the enrichment cannot resolve identities to Entra ID accounts.

Why the Other Options Are Wrong

Conditional Access App Control user monitoring (A) governs app-access session control, not Cloud Discovery identity enrichment. An Azure app connector (D) is not the connector used for this Entra ID UPN enrichment. Automatic redirection to Microsoft 365 Defender (C) is unrelated to Cloud Discovery identity enrichment.

Community Comment Notes

The community is unanimous (B 100). certinfra (10 likes) cites the cloud-discovery-aad-enrichment documentation and notes the Microsoft 365 app connector must be connected first, with sapphire and Vokuhila confirming B.

Official Reference

https://learn.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-aad-enrichment

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. certinfra 👍 10
    Microsoft 365 app connector has to be connected first before you can enrich Cloud Discovery data: https://learn.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-aad-enrichment
  2. Vokuhila 👍 2 Answered B
    B is correct. See prerequisites on https://learn.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-aad-enrichment
  3. sapphire 👍 2 Answered B
    B is correct answer. https://learn.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-aad-enrichment

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide