How app governance in Defender for Cloud Apps inventories OAuth apps registered in Entra ID, Google Workspace and Salesforce, scores their permissions and data usage, detects consent phishing and anomalous app behaviour, and how it fits with Entra user consent settings and the admin consent workflow.
Which Intune profile type to use for Windows and macOS, how settings reach the device through MDM CSPs and the Intune Management Extension, how conflicts are resolved and reported, and how platform scripts, remediations, filters, policy sets and Graph export fit together.
What Intune manages through MDM enrolment and MAM without enrolment, the platforms it covers, how the admin center and Graph namespaces are laid out, Plan 1 versus Plan 2 versus Intune Suite with its add-ons, user and device licensing, and the tenant setup steps that must be done before the first device enrols.
The eight Defender for Cloud Apps policy types, what the built-in anomaly detections flag and how to scope them, file policies with Purview labels, per-app governance actions, the activity log, the alert lifecycle in Defender XDR, Sentinel paths, the Activities and Alerts API, and a troubleshooting table for the whole product.
The Intune diagnostic toolkit, the Troubleshooting blade, device sync, MDM diagnostic report, DeviceManagement event log, IME logs with CMTrace, Collect diagnostics, enrolment error codes, the Reports blade, Endpoint analytics, the data warehouse, exportJobs, and Log Analytics routing.
App registration vs service principal vs managed identity, application vs delegated permissions, admin consent, secrets vs certificates vs federated credentials, Workload ID Premium, the app registration hardening checklist, and how to monitor service principal credentials and sign-ins.