To add Microsoft SharePoint Online as a Conditional Access App Control app, you must create a Conditional Access policy in the Microsoft Entra admin center that routes traffic to Microsoft Defender for Cloud Apps. Because SharePoint Online is a native Microsoft application, it onboards automatically to Defender for Cloud Apps as soon as a user session triggers the policy for the first time.
Follow these steps to complete the deployment:
Create the Conditional Access Policy in Microsoft Entra
Step 1: Sign in to the Microsoft Entra admin center as a Conditional Access Administrator.
Step 2: Navigate to Identity > Protection > Conditional Access.
Step 3: Select + New policy.
Step 4: Under Assignments, select Users to include your targeted users or groups.
Step 5: Under Target resources, choose Select apps, search for, and select Office 365 SharePoint Online (or Office 365 to include all core suites).
Step 6: Under Conditions > Client apps, set the toggle to Yes, check the Browser box, and click Done. (Session control only applies to interactive browser sessions).
Step 7: Under Access controls > Session, select Use Conditional Access App Control.
Step 8: Choose a policy type from the dropdown, such as Use custom policy (recommended for advanced granular rules) or Monitor only.
Step 9: Set Enable policy to On, and click Create.
Reference:
https://learn.microsoft.com/en-us/defender-cloud-apps/access-policy-aad