The SC-300 Exam Ref and official Microsoft Learn module "Plan and implement user provisioning" confirm that automatic user provisioning between Microsoft Entra ID (formerly Azure AD) and external SaaS applications uses the System for Cross-domain Identity Management (SCIM) 2.0 protocol.
SCIM 2.0 is an op en standard that simplifies identity lifecycle management - enabling automatic creation, update, and removal of user accounts within connected SaaS applications. When a SaaS app supports SCIM
2.0, Entra ID can automatically synchronize user identities and attributes based on defined mappings.
Other protocols listed, such as WS-Fed , LDAP , or OAuth 2.0 , serve different purposes - authentication and directory access rather than provisioning. WS-Fed is used for federated authentication; LDAP provides directory querying; OAuth 2.0 handles delegated authorization for resource access.
Thus, any enterprise SaaS app that supports automatic provisioning from Entra ID must implement SCIM
2.0 as per Microsoft's integration requirements.

According to the Microsoft SC-300: Identity and Access Administrator study materials and Microsoft Learn modules under "Implement and manage Cloud App Security (Microsoft Defender for Cloud Apps)", the Cloud App Discovery feature in Microsoft Cloud App Security (now called Microsoft Defender for Cloud Apps ) is designed to identify and analyze the use of shadow IT - unmanaged or unsanctioned applications accessed by users within the organization.
Cloud App Discovery collects logs from network appliances such as firewalls, proxies, or Secure Web Gateways (SWGs). Administrators upload these logs into Cloud App Security or configure continuous log collection through automatic log uploaders. The service then parses and analyzes the data to detect which external applications are being accessed and which users are using them.
In this scenario, since users authenticate to the firewall with their on-premises Active Directory credentials, the firewall logs will contain user information and the external applications being accessed. By importing these logs into Cloud App Discovery, administrators can generate a detailed list of unmanaged (unsanctioned) external applications and identify the specific users connecting to them.
Microsoft documentation explicitly states:
"Cloud App Discovery analyzes traffic logs to identify all cloud applications used in your organization. It provides information about app usage, users, IP addresses, and risk levels to help you assess shadow IT." Hence, the correct and verified answer - based on official SC-300 curriculum and Azure AD Identity Governance content - is Cloud App Discovery in Microsoft Cloud App Securit

Before you can create a session policy in Microsoft Defender for Cloud Apps (MCAS), you must enable real-time session control integration through Conditional Access. This is achieved by creating a Conditional Access policy that uses the "Use Conditional Access App Control" session control option.
As explained in SC-300's "Manage Cloud App Security integration" module, Conditional Access policies are the gateway for routing session traffic through Defender for Cloud Apps for monitoring or control.
Options A, C, and D in the question represent post-deployment or reporting tasks, not the initial configuration step needed to enable session control.
# Correct Answer: B. From the Microsoft Entra admin center, create a Conditional Access policy.

Azure AD supports several group types with different membership rules. For Microsoft 365 groups, "group nesting isn't supported; only user identities can be members." For mail-enabled security groups used in Azure AD/Exchange Online, the SC-300 materials emphasize that only user objects are supported as members when managed in Azure AD, while "Microsoft 365 groups can't be added to other groups." Security groups are commonly nestable for access scenarios, but the mail-enabled security group membership experience in Azure AD limits member selection to users; thus you cannot add Group1 (security group) or Group2 (Microsoft 365 group) as members of Group3 (mail-enabled security group). Licensing assignments shown in the table are irrelevant to membership eligibility. Consequently, the only valid members you can add to Group3 are the user objects - User1 and User2.