A company wants to find sensitive data already stored in a sanctioned SaaS collaboration application, including files uploaded months before any monitoring was in place. Which approach best fits this requirement?

A cloud access security broker can operate inline, as a forward or reverse proxy that inspects traffic in real time, or out of band through the SaaS provider's APIs. API mode connects to a sanctioned application with administrative authorization and can enumerate and scan content already stored there, along with sharing settings and user activity, regardless of when or from where files were uploaded. That matches the requirement to discover historical data at rest inside the SaaS application. A forward proxy sees only traffic that passes through it from managed users, so it cannot inspect files uploaded before deployment or from unmanaged devices. A network DLP appliance on the corporate egress similarly inspects only traffic leaving the office network from now on, and has no visibility into the SaaS tenant's stored content. Scanning local disks with an endpoint agent finds only files that happen to be synced to managed devices, missing content uploaded from other devices or never synced. Exam caveat: API mode is best for data at rest and sanctioned applications, while proxy mode suits real-time control and shadow IT discovery; the two are often combined. Operational check: confirm the API connector's scope covers all sites and users in the tenant and review the first full scan with data owners.