According to the Microsoft Identity and Access Administrator (SC-300) Study Guide , Exam Ref SC-300 , and Microsoft Defender for Cloud Apps (MDCA) documentation , a session policy in Defender for Cloud Apps (formerly Microsoft Cloud App Security) is used to monitor and control user sessions in real time. These policies provide granular session-level access controls such as limiting downloads, blocking uploads, or monitoring user activity in SaaS applications integrated with Defender for Cloud Apps.
However, before a session policy can function, the Conditional Access App Control feature must be enabled. This integration connects Azure Active Directory (Azure AD) with Microsoft Defender for Cloud Apps , allowing session control to be enforced through Conditional Access policies .
The SC-300 official training content under “Implement and configure Microsoft Defender for Cloud Apps” states:
“To apply session controls using Microsoft Defender for Cloud Apps, you must first configure a Conditional Access policy in Azure AD that routes user sessions to Defender for Cloud Apps for inspection. Only after this step can you define a session policy within the Defender for Cloud Apps portal.”
Thus, the correct first step is to create a Conditional Access policy in Azure AD that uses the Use Conditional Access App Control option. This action establishes the required connection path so that session control policies in Defender for Cloud Apps can take effect.
