A municipal CIO worries about shadow IT SaaS that staff adopt without approval and wants visibility into those cloud app risks. Which Defender product addresses that CASB-style need?

Microsoft Defender for Cloud Apps addresses CASB-style needs when a municipal CIO wants visibility into shadow IT SaaS that staff adopt without approval. It helps security teams discover and assess cloud app usage risks beyond the official Microsoft 365 stack, which is common in cities where departments subscribe to niche SaaS for permits, surveys, or field inspections. MS-900 associates Defender for Cloud Apps with cloud application security posture and shadow IT visibility rather than with whiteboarding or Cloud PC sizing.

Microsoft Whiteboard for workshop brainstorming is not a CASB. Microsoft Loop workspaces for project notes are collaboration surfaces, not cloud-app risk gateways. Windows 365 Cloud PC sizing alone addresses desktop compute sizing, not unsanctioned SaaS discovery.

An exam caveat is that visibility often starts with discovery and risk scoring before blocking; municipal CIOs should plan governance workflows after first seeing what shadow IT exists. Operationally, enable Defender for Cloud Apps discovery for the city tenant, review the unsanctioned app list with department leads, and prioritize investigation of high-risk SaaS touching citizen or financial data. Shadow IT reviews should also distinguish personal convenience apps from systems that store building permits, health records, or payment artifacts, because retention and residency expectations differ across those municipal data classes. Capture the decision in the city’s cloud app register so future audits can see why an app was allowed, replaced, or blocked.