Explanation:

When onboarding Google Cloud Platform (GCP) to Microsoft Defender for Cloud using the native cloud connector , the integration process is performed within GCP to allow Defender for Cloud to continuously monitor all existing and future GCP projects under the organization.
Step 1: Create a management project and a custom role According to Microsoft Defender for Cloud's official onboarding documentation for GCP, the connector setup requires the creation of a management project in GCP. This project acts as a central control point for all future onboarding operations. In that project, you create a custom IAM role that defines the minimum required permissions for Defender for Cloud to access security posture, asset inventory, and threat detection data from GCP resources.
This ensures least-privilege access and allows automatic onboarding of all new GCP projects under the same organization (GCP1).
Step 2: Run the setup script in GCP Cloud Shell Microsoft provides a deployment script that you execute from the GCP Cloud Shell . Running the script there automates:
* Creation of the management project
* Assignment of the custom role
* Configuration of the service account and necessary API permissions
* Establishment of the continuous connector between GCP and Defender for Cloud Running it in Azure Cloud Shell would not have the required GCP SDK environment or permissions to modify GCP IAM and projects, hence GCP Cloud Shell is required.
# Final Answers:
* Create: A management project and a custom role
* By: Running a script in GCP Cloud Shell