You want to use an out-of-band API connection into your sanctioned Microsoft 365 OneDrive for Business application to find sensitive content, enforce…

The scenario requires an out-of-band API connection to a sanctioned SaaS application (Microsoft 365 OneDrive) for scanning data-at-rest, enforcing policies, and threat protection. Netskope's SaaS API-enabled Protection is the specific function designed for this purpose. It directly integrates with the SaaS application's API to provide visibility and control over data and threats without being in the real-time traffic path. This allows for retrospective scanning of all existing data and near real-time enforcement on new or modified files.

A. DLP forensics: This is a capability for investigating policy violations after they have been detected, not the primary function used to connect the application to Netskope for protection.

B. Risk Insights: This function provides visibility and risk assessment of cloud applications (e.g., Cloud Confidence Index), but it is not the mechanism for API-based policy enforcement and threat protection.

C. IaaS API-enabled Protection: This function is specifically for Infrastructure-as-a-Service (IaaS) platforms like AWS, Azure, and GCP, not for SaaS applications like Microsoft 365 OneDrive.

1. Netskope Official Documentation

"API-enabled Protection." This document outlines the architecture for connecting to sanctioned cloud services. Section "SaaS API-enabled Protection" explicitly states its purpose is to "scan sanctioned SaaS apps for data-at-rest" to "find sensitive data

and identify and quarantine malware." It lists Microsoft 365 as a primary use case. (Refer to Netskope Tech Docs

Cloud App Security > API-enabled Protection section).

2. Netskope Solution Brief

"Netskope for Microsoft 365." This document details the multi-faceted approach to securing M365. Page 3

under the heading "API-enabled protection for data-at-rest

" describes how Netskope connects to OneDrive via API to "continuously scan for sensitive data and malware...with policy actions like quarantine."

3. Carnegie Mellon University

"18-731: Network Security - Cloud Security

" Lecture Notes. In discussions on Cloud Access Security Broker (CASB) architectures

the courseware distinguishes between inline (proxy) and out-of-band (API) modes. The API mode is described as essential for scanning data-at-rest in sanctioned services like Office 365

which directly aligns with the question's scenario. (See course materials on CASB deployment models).