Traffic to https://www.adatum.com:8433:
In WCFPolicy1, the only rule specifies *.adatum.com as the allowed domain but without specifying a particular port.
Typically, web content filtering applies only to standard HTTP/HTTPS traffic (ports 80 and 443).
Since this traffic is over port 8433, which is nonstandard, it would not match the allow rule in WCFPolicy1. Thus, it will be blocked from all devices.
Traffic to https://www.fabrikam.com:
Since there is no rule in WCFPolicy1 to specifically allow or block traffic to fabrikam.com, the Conditional Access policy CAPolicy1 will govern access.
CAPolicy1 is configured to grant access only if a user's device is compliant. Therefore, traffic to
https://www.fabrikam.com will be allowed only from compliant devices

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) can be used to monitor user activity across SaaS applications in Azure and Microsoft 365, detect risky behavior in real-time, and align with Microsoft's security benchmarks and architectures. It acts as a comprehensive SaaS security solution, going beyond traditional CASB capabilities to provide full visibility and control over your SaaS environment.
In essence, Microsoft Defender for Cloud Apps provides a comprehensive solution for securing SaaS applications in Azure and Microsoft 365, aligning with Microsoft's security benchmarks and reference architectures by offering real-time threat detection, data protection, and access control capabilities.
Reference:
https://learn.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps

Explanation:
Box 1: Account shared access signature (SAS)
Azure Storage blobs
Limit access to the blobs to specific periods of time
Account SAS
An account SAS is secured with the storage account key. An account SAS delegates access to resources in one or more of the storage services. All of the operations available via a service or user delegation SAS are also available via an account SAS.
Box 2: Service shared access signature (SAS)
Azure Files shares
Support access to the shares by using the SMB protocol.
A shared access signature can take one of the following two forms:
* Ad hoc SAS. When you create an ad hoc SAS, the start time, expiry time, and permissions are specified in the SAS URI. Any type of SAS can be an ad hoc SAS.
*-> Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share. The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints--the start time, expiry time, and permissions--defined for the stored access policy.
Reference:
https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Correct Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.
Restrict access to a specific Azure Front Door instance.
Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.

Reference:
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#managing-access- restriction-rules