[D 5.2] App Governance: The OAuth Consent Control Plane
App governance is where you see the OAuth grants your users made and switch off the dangerous ones. The consent-phishing control plane, and what it hands to identity and to the capstone.
Category Defender XDR
[D 5.1] Discovery, Shadow IT, and Shadow AI: The Enforcement Loop
Discovery is only half the job. How Defender for Cloud Apps sees the shadow-IT and shadow-AI estate and turns an unsanctioned tag into a real block through Defender for Endpoint, with no infrastructure to stand up.
[D 5] Defender for Cloud Apps: Seeing and Governing the SaaS Estate
What Defender for Cloud Apps actually is in 2026: five durable pillars, a licensing spine with one useful asymmetry, and the file-protection pillar leaving for Purview in January 2027.
[D 4.2.1] Build Sheet: Configuring the Protection Stack
A reproducible walkthrough: turn on collaboration protection and close the download door, make the Safe Links rewrite decision explicit, and set the anti-phishing engine to act, with self-tests that prove each engine is live.
[D 4.1.1] Build Sheet: Standing Up the Policy Baseline
A reproducible walkthrough: enable and scope the Standard preset, populate the impersonation lists by hand, carve one custom exception, and wire quarantine notifications, validated end to end.
[D 4.3] Operating Mail Security: Submissions, Quarantine, and the Queue
Prevention is bought once. Operations is the part that never stops, and it is where Defender for Office 365 either earns its place or gathers dust.
[D 4.2] The Protection Stack: What Safe Links, Safe Attachments, and Anti-Phishing Actually Do
Three engines do the real catching, and each hides one decision that matters more than the rest. Teams is now inside the same blast radius.
[D 4.1] Policy Architecture: Presets, Precedence, and the Work That Remains
The mail policy layer is a precedence order, not a pile of settings, and the first policy to match a user wins outright. Knowing which policy speaks for whom is the whole discipline.
