A city shadow-IT review needs visibility into unsanctioned SaaS usage, while device enrollment remains a separate endpoint program. Which pairing is correct?
Select an answer to reveal the explanation.
Short Explanation
Cloud Apps watches the SaaS neighborhood for risky apps and activity. Intune wrangles phones and PCs. Same city, different departments—do not merge the org charts.
Full Explanation
A city shadow-IT review that needs visibility into unsanctioned SaaS usage is a cloud app security / CASB-style problem, while device enrollment remains an endpoint-management problem. Microsoft Defender for Cloud Apps provides cloud app security visibility and control patterns for SaaS usage; Microsoft Intune provides endpoint management for phones and PCs. Keeping that pairing straight prevents merging two different municipal programs into one incorrect product answer.
Defender for Cloud Apps does not manage Autopilot hardware hashes, and Intune is not the primary shadow-SaaS discovery CASB—those roles are reversed in the distractor. Defender for Cloud Apps does not replace Exchange Online mailboxes. Intune is not the CASB-style SaaS visibility tool, and Defender for Cloud Apps does not enroll phones; enrollment is Intune’s job.
Exam caveat: some Microsoft 365 suites bundle multiple Defender capabilities—still map each scenario to the right capability name on the exam rather than assuming one product does every security job. Operational check: inventory discovered cloud apps in Defender for Cloud Apps for the city tenant, separately review Intune enrollment and compliance for managed devices, and document which team owns SaaS governance versus endpoint enrollment.