Exam MS-500 topic 4 question 85 discussion

No, installing a Microsoft Defender for Identity sensor on the server will not meet the goal of discovering which cloud apps are accessed from the computers. Microsoft Defender for Identity is a cloud-based solution that helps you protect your organization from advanced threats by detecting suspicious activities and attacks. It works by monitoring user activities and authentication events in your organization's Active Directory environment. It does not provide information on the cloud apps accessed from the computers. To discover which cloud apps are accessed from the computers, you should use Microsoft Cloud App Security (MCAS) which is part of Microsoft Defender for Cloud Apps. MCAS provides visibility into the cloud apps accessed from your network and allows you to control access to those apps. You can use MCAS to discover cloud apps that are used in your organization and identify potential risks associated with those apps. To do this, you need to configure MCAS to collect logs from the firewall that utilizes syslog and analyze those logs to identify the cloud apps accessed from the computers.

I don't think A. Defender for Identity enables SecOp analysts and security professionals struggling to detect advanced attacks in hybrid environments to: Monitor users, entity behavior, and activities with learning-based analytics Protect user identities and credentials stored in Active Directory Identify and investigate suspicious user activities and advanced attacks throughout the kill chain Provide clear incident information on a simple timeline for fast triage No mention about "discover which cloud apps are accessed from the computers" https://learn.microsoft.com/en-us/defender-for-identity/what-is

Definitely not A. You'd either be getting a snapshot log from the FW or setting up continuous logging from it. Regardless, users have the M365 E5 which contains Defender for Endpoint Plan 2, allowing client devices to continuously log to the portal

answer B

https://docs.microsoft.com/en-us/defender-cloud-apps/mdi-integration