When you plan to onboard a third-party SaaS application (App1) to Microsoft Defender for Cloud Apps (MDA/MCAS) and need to enforce session control policies such as monitoring or restricting downloads, the application must first be integrated with Microsoft Entra ID through Single Sign-On (SSO).
According to the Microsoft SC-300: Identity and Access Administrator study guide and official documentation, session controls in Defender for Cloud Apps depend on Conditional Access App Control, which only works with apps federated through Microsoft Entra ID (SSO-enabled). This integration allows Conditional Access to apply real-time monitoring and control of user sessions by routing the app's authentication through Entra ID.
Here's the required sequence outlined in the SC-300 materials:
* Configure SSO for App1 in Microsoft Entra admin center.
* Create a Conditional Access policy with "Use Conditional Access App Control."
* The policy then redirects sessions through Defender for Cloud Apps to enforce session controls (e.g., block download, monitor activity).
Other options do not achieve the initial requirement:
* A. Cloud Discovery only identifies unsanctioned apps but cannot apply session controls.
* B. Traffic forwarding profile applies to Global Secure Access, not SaaS onboarding.
* D. OAuth app policy targets API permissions, not real-time session enforcement.