You have a Microsoft 365 E5 subscription. Users authorize third-party cloud apps to access their data. You need to configure an alert that will be…

An OAuth app policy in Microsoft Defender for Cloud Apps is specifically designed to manage and create alerts for third-party applications that users have authorized via OAuth. This policy type allows an administrator to define rules based on the app's properties, such as its permission level (e.g., high, medium, low) and the number of users who have granted it consent. The scenario requires an alert when a high-permission app is authorized by more than 20 users, which directly aligns with the filtering capabilities of an OAuth app policy.

A. anomaly detection policy: These policies use machine learning to identify unusual user behavior based on established baselines, not for creating alerts based on predefined app attributes like permission level and user count.

C. access policy: These are real-time session controls, part of Conditional Access App Control, used to monitor or block user access to specific applications, not to alert on the characteristics of authorized OAuth apps.

D. activity policy: These policies trigger alerts based on specific user activities (e.g., mass download, multiple failed sign-ins), not on the cumulative state or attributes of an application itself.

---

1. Microsoft Learn. (2023). Manage OAuth apps.

Section: "Create OAuth app policies"

Content: This document explicitly states

"You can create OAuth app policies to automatically notify you when an OAuth app meets certain criteria." It lists the available filters for creating a policy

which include "Permission level" and "Users" (the number of users using the app)

directly matching the requirements in the question.

2. Microsoft Learn. (2023). Control cloud apps with policies.

Section: "Policy types"

Content: This page provides an overview of different policy types. It describes "OAuth app policies" for alerting on "suspicious OAuth apps

" "Access policies" for "real-time monitoring and control

" and "Activity policies" for alerting on "suspicious activity." This distinction supports the choice of OAuth app policy for the given scenario.

3. Microsoft Learn. (2023). Anomaly detection policies in Microsoft Defender for Cloud Apps.

Section: "How anomaly detection policies work"

Content: This source details that anomaly detection policies work by profiling the environment and triggering alerts on activities that are anomalous compared to a learned baseline. This confirms it is not the correct tool for a rule with static

predefined thresholds.