A supported SaaS app needs additional session controls based on Conditional Access integration, such as governing downloads in a risky session. Which capability should be evaluated?

1. An Azure subnet NSG for every SaaS browser action
2. A storage retention label as the session proxy
3. A directory user display-name change
4. Conditional Access App Control in Defender for Cloud Apps