According to the Microsoft Identity and Access Administrator (SC-300) Study Guide , Exam Ref SC-300
, and Microsoft Defender for Cloud Apps (MDCA) documentation , a session policy in Defender for Cloud Apps (formerly Microsoft Cloud App Security) is used to monitor and control user sessions in real time. These policies provide granular session-level access controls such as limiting downloads, blocking uploads, or monitoring user activity in SaaS applications integrated with Defender for Cloud Apps.
However, before a session policy can function, the Conditional Access App Control feature must be enabled. This integration connects Azure Active Directory (Azure AD) with Microsoft Defender for Cloud Apps , allowing session c ontrol to be enforced through Conditional Access policies .
The SC-300 official training content under "Implement and configure Microsoft Defender for Cloud Apps" states:
"To apply session controls using Microsoft Defender for Cloud Apps, you must first configure a Conditional Access policy in Azure AD that routes user sessions to Defender for Cloud Apps for inspection. Only after this step can you define a session policy within the Defender for Cloud Apps portal." Thus, the correct first step is to creat e a Conditional Access policy in Azure AD that uses the Use Conditional Access App Control option. This action establishes the required connection path so that session control policies in Defender for Cloud Apps can take effect.

Azure RBAC roles on a scope (subscription, resource group, resource) can be assigned to Azure AD security principals: users , groups , and service principals (which includes enterprise applications and managed identities). The SC-300 content states: "RBAC roles can be assigned to users, groups, and applications (service principals), including system-assigned managed identities created for Azure resources." In the table, User1 (user), Group1 (security group), VM1 (a VM with system-assigned managed identity), and App1 (an enterprise application service principal) are all valid principals. Therefore, all four can be assigned the Contributor role at the RG1 scope. This enables least-privilege delegation to workloads (VM1/App1) and to people (User1/Group1) without granting broader directory roles.

Per Microsoft SC-300: Manage administrative units and delegated roles , administrative units (AUs) allow scoping of administrative privileges to subsets of users or groups within a tenant.
In this case, User5 is assigned the User Administrator role for AU1. This means User5 can only manage users and groups that are members of AU1. From the given table, Group1, User2, and User3 are part of AU1.
Therefore, User5 can reset passwords for users who are either:
* Members of AU1 directly (User2, User3), or
* Members of groups that belong to AU1, if those groups' members fall under delegated scope.
However, User1 and User4 are not part of AU1, and User5 has no administrative control over them.

Explanation:

User1 is eligible for the Application Administrator role and needs to configure an Application Proxy connector group. Application Proxy is an Azure AD feature used to publish on-premises applications securely.
To activate the eligible role, User1 must perform a Privileged Identity Management (PIM) activation within the Azure AD admin center.
From Microsoft Documentation:
"Privileged Identity Management (PIM) role activations are performed in the Azure AD admin center under Azure AD # Privileged Identity Management # My roles." Activation steps are not available through Microsoft 365 or Defender portals.