A team wants to bring a non-Microsoft SaaS application that supports single sign-on with Microsoft Entra ID under session policy control in Microsoft Defender for Cloud Apps. The app is not on the list of automatically onboarded apps. What is the correct way to make this app eligible for Conditional Access app control session policies?
- AAdd the app to a dynamic application group in Microsoft Entra ID so Defender for Cloud Apps automatically begins proxying its sessions.
- BConnect the app to Defender for Cloud Apps using its API connector so the recorded session traffic is automatically routed through the reverse proxy.
- CCreate a Conditional Access policy with the use Conditional Access app control session control, then onboard the app in Defender for Cloud Apps as a custom app. Correct
- DEnable application-enforced restrictions for the app so Defender for Cloud Apps can substitute its own session policy in place of the app's native limits.
Why A is wrong: Application grouping does not exist as a mechanism that auto-enables proxying, and membership in any group does not connect an app to the Conditional Access app control reverse proxy.
Why B is wrong: App connectors use vendor APIs for visibility and governance of data at rest and do not establish the inline reverse proxy that session policies depend on.
Why C is correct: Session policies require both a Conditional Access policy that routes the app through app control and the app being onboarded in Defender for Cloud Apps, which is how a non-featured SAML or OpenID Connect app becomes proxied.
Why D is wrong: Application-enforced restrictions push limited controls to the app itself and only suit Microsoft 365 services, so they neither onboard the app for proxying nor support custom session policies.