The question asks how to identify which users access Facebook from their devices and browsers using Microsoft Defender for Cloud Apps (MCAS), with minimal administrative effort.
Here's the breakdown:
* Objective: Identify users who access Facebook (a cloud app).
* Tool: Microsoft Defender for Cloud Apps.
* Requirement: Visibility, not control - i.e., detect and report.
To achieve this, the appropriate first step is to create an Access Policy in Defender for Cloud Apps.
An Access Policy allows you to monitor and control real-time session access to cloud apps based on user, device, location, and app usage. It can:
* Detect when a user signs into or uses specific apps (like Facebook).
* Log and alert administrators automatically.
* Require no endpoint or Conditional Access configuration - satisfying the "minimize administrative effort" requirement.
From Microsoft Defender for Cloud Apps documentation:
"Access policies enable monitoring of app access patterns and can trigger alerts when users sign in to or access specific sanctioned or unsanctioned cloud applications." Other options explained:
* (A) Unsanctioning Facebook marks it as disallowed, but does not identify users accessing it.
* (B) App configuration policies in Intune control mobile device settings, not cloud app access.
* (D) Conditional Access policies can block or require conditions for Facebook access but do not report who accessed it.