An administrator account is only as dangerous as what it can do at the moment it is stolen. Why standing privilege is the risk, what eligibility actually changes, and what P2 buys before the Governance SKU takes over.
Session control reaches inside a live browser session, but it rides Conditional Access and carries real limits. Access versus session, in-browser preview versus reverse proxy, and the two dependencies that lock users out.
App governance is where you see the OAuth grants your users made and switch off the dangerous ones. The consent-phishing control plane, and what it hands to identity and to the capstone.
Discovery is only half the job. How Defender for Cloud Apps sees the shadow-IT and shadow-AI estate and turns an unsanctioned tag into a real block through Defender for Endpoint, with no infrastructure to stand up.
What Defender for Cloud Apps actually is in 2026: five durable pillars, a licensing spine with one useful asymmetry, and the file-protection pillar leaving for Purview in January 2027.
A reproducible walkthrough: turn on collaboration protection and close the download door, make the Safe Links rewrite decision explicit, and set the anti-phishing engine to act, with self-tests that prove each engine is live.
A reproducible walkthrough: enable and scope the Standard preset, populate the impersonation lists by hand, carve one custom exception, and wire quarantine notifications, validated end to end.
Prevention is bought once. Operations is the part that never stops, and it is where Defender for Office 365 either earns its place or gathers dust.
