Your security team needs to: prevent data exfiltration from sanctioned SaaS apps (Salesforce and Box) on unmanaged devices with real-time session controls; discover shadow IT from network and endpoint signals; and monitor/remediate risky OAuth apps in Microsoft 365 that request excessive permissions. What should you implement?

The correct solution addresses all requirements. Conditional Access App Control with session policies in Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) provides real-time session controls for sanctioned SaaS apps like Salesforce and Box, preventing data exfiltration even on unmanaged devices. Cloud Discovery, integrated with Microsoft Defender for Endpoint and/or network logs, is essential for discovering shadow IT. The App governance add-on, part of Microsoft Defender for Cloud Apps, specifically monitors and remediates risky OAuth apps in Microsoft 365. Incorrect options: Azure AD Application Proxy is for publishing internal web apps, not for providing real-time session controls for external SaaS apps like Salesforce and Box. Endpoint DLP policies are valuable but do not replace the need for cloud discovery or real-time session controls for browser-based SaaS access. API connectors in Defender for Cloud Apps provide governance and threat protection but do not offer real-time session control. Intune App Protection Policies manage data within mobile apps on unmanaged devices, but do not directly control browser-based access to SaaS apps or provide shadow IT discovery.