How Defender for Cloud Apps takes over a browser session from Entra Conditional Access, through the mcas.ms reverse proxy or Edge for Business in-browser protection, and how access and session policies block downloads, uploads, copy, paste and print on unmanaged devices.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
The eight Defender for Cloud Apps policy types, what the built-in anomaly detections flag and how to scope them, file policies with Purview labels, per-app governance actions, the activity log, the alert lifecycle in Defender XDR, Sentinel paths, the Activities and Alerts API, and a troubleshooting table for the whole product.
The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.