According to the Microsoft SC-300: Identity and Acces s Administrator study materials and Microsoft Defender for Cloud Apps documentation, connecting third-party cloud applications such as GitHub , AWS , and Google Workspace to Defender for Cloud Apps allows the administrator to monitor user activities and OAut h app authentications in those external services.
The App connectors feature within Microsoft 365 Defender / Microsoft Defender for Cloud Apps provides deep visibility into sanctioned cloud applications by integrating their APIs. When an app connector is added
- such as the GitHub app connector - Defender for Cloud Apps begins ingesting audit logs, including OAuth authorization events , sign-in attempts, and token consent grants.
The relevant Microsoft documentation states:
"App connectors use APIs from con nected apps to extend visibility and control to cloud services, enabling monitoring of OAuth application authorizations and security activities." Since the question specifically asks to monitor OAuth authentication requests , adding the GitHub app connector fulfills this requirement because it brings OAuth consent and token data from GitHub into Microsoft 365 Defender (via Defender for Cloud Apps).