How app governance in Defender for Cloud Apps inventories OAuth apps registered in Entra ID, Google Workspace and Salesforce, scores their permissions and data usage, detects consent phishing and anomalous app behaviour, and how it fits with Entra user consent settings and the admin consent workflow.
How Cloud Discovery builds a shadow IT inventory from Defender for Endpoint, log collectors and snapshot uploads, how risk scoring and the Unsanctioned and Monitored tags turn into MDE network protection indicators, and how to verify and troubleshoot the block path.
Defender for Cloud Apps as Microsoft's CASB and SaaS security layer, its four data paths (Cloud Discovery, app connectors, Conditional Access App Control, app governance), the app catalogue and risk scores, how it lands in Defender XDR, what the licences and roles are, and first-time setup.
Page-by-page walk of Settings in the Defender portal, which product owns each page, which toggles reach across products, how device groups drive automation and RBAC, and how to audit who changed what.