Files already stored in the company's sanctioned Microsoft 365 tenant must be scanned for sensitive data and have public sharing links revoked, including files employees uploaded from personal, unmanaged phones that never route through a corporate proxy. Which CASB deployment mode meets this requirement?

An API-based CASB integrates directly with the SaaS provider's APIs, so it can enumerate and scan files that already exist in the tenant, evaluate their content and sharing settings, and take remediation actions such as removing public links or quarantining files. Because it works out of band against the tenant itself, it does not matter which device or network path was used to upload a file; content uploaded from a personal phone is just as visible as content from a managed laptop. That combination of data at rest and device independence is the deciding requirement here. A forward-proxy inline CASB only sees traffic that managed endpoints send through the corporate gateway, so uploads from unmanaged phones bypass it and existing files are never examined. A reverse-proxy inline CASB can cover some unmanaged browser sessions, but it inspects only traffic in flight during those sessions and cannot reach files that were stored earlier. Log-based discovery identifies which applications are used; it neither reads file content nor changes sharing settings. Exam caveat: inline and API modes are complementary, and many deployments use both for real-time and at-rest coverage. Operational check: authorize the CASB against the tenant, run a historical scan, and confirm that files with sensitive matches lose their public links.