Monitoring Third-Party OAuth App Access in Defender for Cloud Apps
Short answer
C Create an OAuth app policy in Microsoft Defender for Cloud Apps to monitor the third-party apps that access Microsoft 365 resources.
Question
You have multiple third-party apps that access the resources in the subscription.
You need to monitor the access of the third-party apps.
What should you create?
Key Takeaways
It tests the Defender for Cloud Apps policy type used for third-party OAuth app visibility; the trap is confusing generic access or app-permission wording with the OAuth app policy construct.
This SC-300 question tests how Microsoft Defender for Cloud Apps monitors third-party apps that access Microsoft 365 resources. The correct policy type is an OAuth app policy (C), which evaluates OAuth app permissions and consent activity.
Common mistake: A common mistake is choosing an access policy because the stem uses the word access; access policies govern user sessions to cloud apps, not third-party OAuth app monitoring.
Expert Analysis
Governing principle In Microsoft Defender for Cloud Apps, third-party apps that obtain access to Microsoft 365 resources are represented as OAuth apps. The documented policy object for observing and controlling those apps is an OAuth app policy. It evaluates an app against conditions such as requested permissions, number of users who consented, publisher, and community use; it can raise alerts and support actions such as revoke or ban. That is the policy type that directly answers a requirement to monitor third-party app access.
Scenario mapping The stem says multiple third-party apps access resources in the subscription and the goal is monitoring, not controlling user sessions to sanctioned cloud apps. Those apps reach mail, files, or other resources through OAuth permission grants, so they fall under Defender for Cloud Apps' OAuth app visibility. Creating an OAuth app policy (C) lets you scope the apps, set severity and notification, and use alert-only mode for monitoring before adding response actions.
Why the distractors fail Option A, an access policy, is about controlling user access and session behavior to cloud apps, such as blocking downloads, not about third-party OAuth app monitoring. Option D, an endpoint protection policy, belongs to endpoint security, not cloud app access. Option B is the tempting one: because the policy inspects OAuth permissions, learners often describe a monitor/control third-party app access (OAuth) tip as an app permission policy, but that wording does not displace the Defender for Cloud Apps policy object required here. The exam signal is the combination of Defender for Cloud Apps, third-party apps, and access to Microsoft 365 resources: choose the OAuth app policy.
Exam takeaway When SC-300 asks how to monitor OAuth apps, do not choose a generic access policy just because the word access appears. Match the cloud-app monitoring feature to the OAuth app policy and reserve access and session policies for user-session control.
Official Reference
https://learn.microsoft.com/en-us/defender-cloud-apps/
This link opens the official vendor documentation in a new tab.
Exam Strategy
When an SC-300 stem names Defender for Cloud Apps and asks about third-party or OAuth apps, eliminate endpoint policies immediately and distinguish application-level monitoring from user-session access control. Look for the phrase that the apps access Microsoft 365 resources through permissions or consent; that points to an OAuth app policy. Generic access policies answer questions about blocking downloads or controlling user sessions, so do not pick them merely because the stem uses the word access.
Frequently Asked Questions
What does an OAuth app policy in Defender for Cloud Apps monitor?
Why is an access policy not the right choice for monitoring third-party apps?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
simbarashem 👍 3 Answered B📝 Quick Decision Matrix (Exam Tip) Requirement Correct Policy Monitor/block user sessions in apps Access/Session policy Audit suspicious or specific activities Activity policy Detect unusual logins or behavior Anomaly detection policy Monitor/control 3rd-party app access (OAuth) App permission policy
-
Obi_Wan_Jacoby 👍 2 Answered CAlso going with answer C. Research below OAuth App Policies: Purpose: Specifically designed to monitor and control permissions requested by OAuth apps. Capabilities: Allow you to investigate which permissions each app requested and which users authorized them. You can also set automated notifications for apps that meet certain criteria, and mark apps as approved or banned. Focus: Provides detailed insights into third-party app permissions and user authorizations, ensuring you have visibility and control over these apps. Access Policies: Purpose: Control access to cloud apps based on user, location, device, and app conditions. Capabilities: Provide real-time monitoring and control over access to cloud apps. Focus: More general control over access to cloud apps, not specifically tailored to monitoring OAuth app permissions. Given your need to monitor third-party apps specifically, OAuth app policies offer more targeted and detailed monitoring capabilities.
-
anbocer 👍 1 Answered CYou have a Microsoft 365 subscription that uses Microsoft Defender for Cloud Apps. You have multiple third-party apps that access the resources in the subscription. You need to monitor the access of the third-party apps. What should you create? A. an access policy B. an app permission policy C. an OAuth app policy D. an endpoint protection policy To monitor the access of third-party apps in your Microsoft 365 subscription using Microsoft Defender for Cloud Apps, you should create an OAuth app policy2. This policy helps you manage and monitor the permissions granted to third-party apps, ensuring that only the necessary permissions are granted and unused permissions are identified and removed. If you have any other questions or need further assistance, feel free to ask!
-
Tuyi 👍 1 Answered CAnswer: C. an OAuth app policy. Why: Third-party apps get into Microsoft 365 by being granted OAuth permissions, for example “read mail” or “access files”. In Defender for Cloud Apps, an OAuth app policy watches those apps against conditions you set, such as permission level, how many users authorized the app, publisher, and community use. It alerts you when an app matches, and it can revoke or ban the app automatically.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →