Before you can create a session policy in Microsoft Defender for Cloud Apps (MCAS), you must enable real-time session control integration through Conditional Access. This is achieved by creating a Conditional Access policy that uses the "Use Conditional Access App Control" session control option.
As explained in SC-300's "Manage Cloud App Security integration" module, Conditional Access policies are the gateway for routing session traffic through Defender for Cloud Apps for monitoring or control.
Options A, C, and D in the question represent post-deployment or reporting tasks, not the initial configuration step needed to enable session control.
# Correct Answer: B. From the Microsoft Entra admin center, create a Conditional Access policy.

According to the Microsoft SC-300 official study guide and Microsoft documentation on Azure AD Privileged Identity Management (PIM), PIM is used to manage, control, and monitor access within Azure Active Directory (Azure AD), Azure resources, and Microsoft 365. However, not every administrative role within Azure or Microsoft 365 can be managed or activated through PIM.
To understand which administrators can use PIM, we need to review how Azure roles are structured:
* Account Administrator - This role is a classic subscription administrator role, not part of Azure AD role-based access control (RBAC). Therefore, it is not managed or activated through PIM.
* Service Administrator - Also a classic Azure subscription role, but it maps to the Owner role in Azure RBAC. PIM can manage and activate this role because it exists within the RBAC model, which PIM supports.
* SharePoint Administrator - This is an Azure AD directory role, not a classic subscription role, and is supported in Azure AD PIM. Azure AD PIM supports activation for directory roles such as Global Administrator, SharePoint Administrator, Exchange Administrator, etc.
From Microsoft's official documentation:
"Azure AD Privileged Identity Management can manage role assignments for both Azure AD directory roles and Azure resource roles (via Azure RBAC). Classic subscription administrator roles such as Account Administrator are not supported." Therefore, Admin1 (Account Administrator) cannot use PIM because their role is outside the scope of PIM.
Admin2 (Service Administrator) and Admin3 (SharePoint Administrator) can both use PIM since their roles are recognized by PIM as eligible for activation.

Explanation:
User1 can sign in from an anonymous IP address: No
User2 can sign in from an anonymous IP address: No
User3 can sign in from an anonymous IP address: No
According to the Microsoft SC-300 Study Guide, Exam Ref SC-300, and Microsoft Entra Conditional Access and Identity Protection documentation, when multiple conditional access (CA) and risk policies are active, Azure AD evaluates them collectively, and if any applicable policy denies access, the user is blocked.
Let's break down the setup:
* User risk policy
* Applies to Group1
* User risk: Low and above
* Access: Block access
* Enforced: On
* Sign-in risk policy
* Applies to Group2
* Sign-in risk: Low and above
* Access: Require MFA
* Enforced: On
* CAPolicy1: Users connect from a trusted IP address (Status: On)
* CAPolicy2: Users' devices are marked as compliant (Status: On)
* CAPolicy3: Sign-in risk is low (Report-only # not enforced)
Identity Protection policies configured: Conditional Access Policies configured:
User Analysis: User
Member of
MFA Status
Applicable Policies
Result
User1
Group1
Enabled but never used
User risk policy # Block access if risk # Low
Cannot sign in (blocked by user risk policy).
User2
Group2
Disabled
Sign-in risk policy # Require MFA
Cannot complete sign-in (MFA required but disabled).
User3
Group1, Group2
Enforced and used
Both policies apply # Block access (user risk policy takes precedence)
Blocked (since one policy enforces deny).
Additionally, CAPolicy1 (trusted IP) denies anonymous IP addresses because anonymous IPs are not trusted or registered - Azure marks such attempts as "risky sign-ins." Thus, regardless of MFA capability, no user can sign in from an anonymous IP address.

Explanation:

Box 1: Yes
Invitations can only be sent to outlook.com. Therefore, User1 can accept the invitation and access the application.
Box 2. Yes
Invitations can only be sent to outlook.com. However, User2 has already received and accepted an invitation so User2 can access the application.
Box 3. No
Invitations can only be sent to outlook.com. Therefore, User3 will not receive an invitation.
Based on the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module
"Manage external collaboration settings in Azure AD", Azure Active Directory provides granular control over external collaboration through External collaboration settings and Collaboration restrictions. These settings control which external domains can receive guest invitations.
1# # Collaboration Restrictions Setting The configuration in the exhibit shows:
"Allow invitations only to the specified domains (most restrictive)"
Target Domain: Outlook.com
This means invitations can only be sent to users whose email domains are explicitly listed (in this case, Outlook.com). Any other external domain (like fabrikam.com or adatum.com) is not permitted to receive or accept invitations.
2# # Evaluating Each User [email protected]
* Domain Outlook.com is listed under allowed domains.
* Although the invitation was initially not accepted , since the domain is allowed, User1 can accept the invitation and gain access. # Answer: Yes [email protected]
* The domain fabrikam.com is not listed in the allowed domains list.
* However, this user already accepted the invitation before the restriction was configured.
* Once a guest has accepted the invitation, they are an existing guest object in Azure AD and retain access unless explicitly removed. # Answer: Yes [email protected]
* Domain adatum.com is not listed under allowed domains.
* Therefore, this user cannot receive or accept new invitations for collaboration resources like SharePoint Online. # Answer: No Summary from Microsoft documentation:
"When collaboration restrictions are set to allow invitations only to specified domains, invitations to all other domains are blocked. Existing guest users who have already accepted invitations remain unaffected." ( Source: Microsoft Learn - Configure external collaboration settings in Azure AD )