In Microsoft Defender for Cloud Apps (MCAS), a Session policy is used to monitor and control user activities in real time when accessing cloud resources through Conditional Access App Control.
The requirement states:
"Prevent users from printing PDF files directly from SharePoint Online." This requires controlling a user's session behavior (e.g., download, print, copy) within a web session - not just detecting or auditing it afterward. According to Microsoft's Identity and Access Administrator training materials:
"Session policies enable real-time monitoring and control of user sessions, allowing you to restrict activities such as printing, downloading, or copying content." By configuring a session policy, administrators can apply real-time controls to prevent printing within SharePoint or Teams sessions while allowing normal view access.
Other options:
* File policy controls data at rest (e.g., classifying or sharing files).
* Activity policy detects historical actions.
* Access policy controls conditions for app access, not user actions.