Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 751–825

This statement is correct as it accurately describes the application's configuration. The 'signInAudience' property being set to 'AzureADMyOrg' confirms it is a single-tenant application, restricted to users within the registering tenant. Furthermore, the 'AppRoles' collection is empty, indicating that no custom application-specific roles have been defined for granular access control within the application itself, while the 'Enabled' status is 'True'.

eDiscovery (Premium) legal holds are specifically designed to preserve content across various Microsoft 365 locations, such as Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams. When a legal hold is applied, it places an immutable preservation lock on all specified content, preventing users from modifying, deleting, or otherwise altering the data, even if a retention policy or label would normally allow it. This ensures that all relevant information is maintained in its original state for legal or investigative purposes, making it the most robust solution for preventing modification and deletion.

Communication Compliance is the dedicated Microsoft Purview solution designed for proactively monitoring and reviewing employee communications across platforms like Microsoft Teams and Exchange. It enables organizations to create policies that detect potential violations, such as harassment, inappropriate content, or regulatory non-compliance, using machine learning and keyword matching. Designated reviewers can then investigate flagged messages, apply remediation actions, and ensure adherence to internal and external standards.

This option is correct because a Sensitive Information Type (SIT) is specifically designed to identify and classify sensitive data based on predefined or custom patterns, keywords, and proximity rules. For detecting Social Security Numbers, a SIT leverages pattern matching (e.g., regular expressions) and checksums to accurately identify these specific data elements across various content sources within Microsoft Purview. This direct detection capability makes it the fundamental classification mechanism for such requirements.

Microsoft Defender for Identity is purpose-built to safeguard on-premises Active Directory environments from sophisticated identity-based attacks. It leverages behavioral analytics to detect suspicious activities like Pass-the-Hash, Golden Ticket attacks, and lateral movement attempts across the network. By monitoring domain controllers and AD FS servers, it provides crucial insights into compromised identities and facilitates automated investigation and response within the Microsoft 365 Defender portal.

Microsoft Defender for Cloud's vulnerability assessment capability actively scans virtual machines, SQL databases, and other resources for security weaknesses, misconfigurations, and missing updates. It identifies known vulnerabilities (CVEs) in operating systems and installed applications, providing actionable recommendations to remediate these findings. This feature is crucial for maintaining a strong security posture by proactively discovering and addressing potential entry points for attackers, often leveraging integrated solutions like Qualys or Microsoft Defender for Endpoint's TVM.

Self-service password reset (SSPR) is the dedicated Azure AD feature that empowers users to securely reset their own forgotten or expired passwords without requiring administrator intervention. Users must first register and verify authentication methods, such as a mobile phone or alternate email, which are then used to confirm their identity during the reset flow. This capability directly addresses the organization's need to allow users to manage their own passwords, enhancing both security and user productivity.

Microsoft Purview Compliance Manager is the primary solution for a compliance officer to evaluate their organization's adherence to various regulatory standards and internal policies. It provides a quantifiable compliance score, pre-built assessment templates for numerous global and industry-specific regulations (e.g., GDPR, HIPAA, ISO 27001), and actionable recommendations. This service enables organizations to manage and track improvement actions, assign responsibilities, and generate reports to demonstrate compliance posture effectively.

Creating a dynamic group with the rule user.department -eq "Finance" directly fulfills the requirement for automatic group membership. Microsoft Entra ID dynamic groups continuously evaluate user attributes against defined rules, automatically adding users whose 'department' attribute matches "Finance" and removing those who no longer meet the criteria. This ensures that the group membership remains accurate and up-to-date without manual intervention, significantly reducing administrative overhead. This feature requires a Microsoft Entra ID P1 or P2 license.

Configuring role settings to require approval on activation directly addresses the need for a manager to authorize privileged access. When a user attempts to activate a role, Microsoft Entra ID PIM routes the request to predefined approvers, who are typically managers or security administrators. The role remains inactive until at least one designated approver explicitly grants permission, ensuring an independent review and authorization before elevated privileges are granted.

Sensitivity labels in Microsoft Purview allow organizations to classify and protect content based on its sensitivity. Labels can be applied manually or automatically using policies that detect sensitive information types. Once labeled, the content can be encrypted, marked with visual markings, and restricted from sharing. This directly meets the requirement to automatically classify and label sensitive information in emails and documents.

This principle mandates that all access requests, regardless of origin or resource, must be authenticated and authorized rigorously. It involves continuously evaluating user identity, device health, location, and other contextual signals before granting or maintaining access. This explicit verification ensures that no entity is inherently trusted and access is always granted based on real-time policy enforcement.

Separation of duties is a critical control in financial systems, ensuring that no single individual possesses all the necessary permissions to complete a high-risk transaction or process from start to finish. For instance, the person who approves a payment should not be the same person who initiates the payment or reconciles the bank statement. This distribution of incompatible privileges across multiple employees significantly mitigates the risk of fraud, errors, and insider threats by requiring collusion to bypass controls.

Configuring a DLP policy tip that allows users to override the block with a business justification is the optimal solution. This approach provides real-time notification to users when a potential policy violation occurs, offering them the flexibility to proceed if they can provide a valid business reason. This balances robust data protection with operational continuity, ensuring legitimate workflows can proceed while maintaining an auditable record of all overrides and their justifications for compliance and accountability.

Grant controls are the specific mechanisms within a Conditional Access policy that determine how access is granted or denied, and what requirements must be satisfied before access is permitted. By configuring 'Require multi-factor authentication' under Grant controls, the policy explicitly mandates that users must successfully complete an MFA challenge before they can gain access to the protected resource. This directly enforces the MFA requirement, making it the correct choice for this scenario.

Microsoft Entra B2B collaboration is the correct solution for securely providing external partners with access to your organization's resources. It enables guest users to sign in using their own existing identities, such as work, school, or social accounts, without requiring them to create new credentials in your tenant. This streamlined process facilitates collaboration by inviting external users to access specific applications or documents while maintaining administrative control over their permissions.

A Microsoft Purview DLP policy evaluates sensitive information types such as credit card numbers across Exchange Online email, then enforces block, encryption, user notification and override with business justification in one rule set. This satisfies all five requirements with minimal administrative overhead, since E5 licensing already includes the necessary Purview capabilities.

"Verify explicitly" is a foundational principle of Zero Trust, mandating that all access requests, regardless of origin, must be thoroughly authenticated and authorized before granting access. This involves evaluating multiple dynamic data points, including user identity, device health, service or workload, data classification, location, and detected anomalies, to make an informed, real-time access decision. It fundamentally shifts security from perimeter-based trust to continuous, granular validation, never implicitly trusting anything inside or outside the network.

Microsoft Entra self-service password reset (SSPR) is a crucial feature that empowers users to reset their forgotten or locked passwords without administrator intervention. SSPR can be configured to require users to verify their identity through multiple authentication methods, including MFA, before they can successfully reset their password, thereby enhancing both convenience and security for password management within the organization.

Microsoft Defender for Endpoint is a comprehensive enterprise endpoint security platform designed to protect devices from advanced threats. It offers Endpoint Detection and Response (EDR) capabilities, next-generation protection, attack surface reduction, and automated investigation and remediation. This solution actively monitors endpoints for malicious activity, isolates compromised devices, and provides a unified view of security incidents across an organization's device fleet, making it ideal for endpoint deployment.

Microsoft Entra External ID is the comprehensive solution for managing all external identities, including customers, partners, and citizens, across various applications. It specifically supports integrating social identity providers like Google, Facebook, and Microsoft accounts, as well as enterprise identity providers, allowing users to sign in to your applications using their existing credentials. This capability is crucial for consumer-facing applications that require flexible and convenient sign-up and sign-in experiences without creating new accounts.

Microsoft Purview Data Loss Prevention (DLP) actively identifies, monitors, and protects sensitive information across endpoints, cloud applications, and on-premises repositories. It enforces policies to prevent the unauthorized sharing, transfer, or exfiltration of sensitive data, whether accidental or malicious, by detecting specific content and context and blocking or auditing the action. This proactive approach is fundamental to safeguarding an organization's critical information assets.

External ID is the Microsoft Entra feature designed for external identities, letting partners authenticate with their own identity provider through federation or guest accounts. It satisfies the requirement for partner access using their existing credentials, rather than creating and managing separate local accounts.

A passport number is considered sensitive information because it is a unique government-issued identifier directly linked to an individual's identity, nationality, and travel history. Unauthorized disclosure could lead to severe consequences such as identity theft, fraud, or impersonation. Microsoft Purview includes "Passport Number" as a predefined sensitive information type (SIT), utilizing pattern matching, keywords, and proximity to detect and protect this critical personal data across an organization's digital estate, aligning with global privacy regulations.

A Data Loss Prevention (DLP) policy is specifically engineered to identify, monitor, and automatically protect sensitive information across various locations and sharing scenarios. It leverages sensitive information types (SITs) to detect specific content patterns, such as credit card numbers, within documents or emails. Upon detection, a DLP policy can be configured to block external sharing in real-time, notify administrators, and provide policy tips to users, directly addressing the need to prevent sensitive data from leaving the organization.

This policy explicitly requires both multi-factor authentication (MFA) and a compliant device as grant controls. For access to be permitted, all specified grant controls must be satisfied simultaneously. Since the user has not registered for MFA, this critical requirement is not met, leading to the conditional access policy blocking the access attempt.

eDiscovery (Standard) supports creating holds on Exchange mailboxes and SharePoint or OneDrive sites, and the user's mailbox and OneDrive can both be placed on hold within a single case. It satisfies the litigation-hold requirement without the premium custodian and review-set features of eDiscovery (Premium).

Under 'Conditions', configuring 'Client apps' allows administrators to target specific client applications and authentication protocols. By selecting 'Other clients' (which includes clients using legacy authentication protocols like Exchange ActiveSync, POP, IMAP, and older Office clients), and then applying a 'Block' grant control, the policy effectively prevents sign-ins from these legacy methods. This precisely addresses the requirement to block legacy authentication without impacting modern authentication flows.

Data Lifecycle Management (DLM) in Microsoft 365 utilizes retention labels to define how long content should be retained or deleted across various services, ensuring compliance with organizational policies and regulations. Concurrently, eDiscovery holds (also known as litigation holds) are specifically designed to preserve content indefinitely for legal proceedings, overriding any existing retention or deletion policies applied by retention labels. This combination effectively addresses both routine data retention and specific legal preservation requirements.

Microsoft Entra Conditional Access is a policy engine that evaluates conditions, including user and sign-in risk levels detected by Identity Protection, to enforce specific access controls. It allows administrators to define "if-then" statements, such as "if a user is signing in from a risky location, then block access or require multi-factor authentication." This direct integration makes it crucial for implementing risk-based access policies.

Microsoft Entra ID Protection uses machine learning to detect risks like impossible travel and anomalous token issuance, and can automatically enforce policies such as requiring MFA or blocking sign-ins. It also integrates with threat intelligence feeds.

Integrity is the fundamental security principle that ensures data remains accurate, complete, and unaltered by unauthorized parties throughout its lifecycle. It guarantees that information has not been tampered with, either accidentally or maliciously, maintaining its trustworthiness and reliability. Mechanisms such as cryptographic hashing, digital signatures, and robust access controls are employed to detect or prevent unauthorized modifications, thereby preserving the validity and consistency of the data.

This is the correct configuration because Microsoft Entra Conditional Access policies use 'Grant controls' to define the specific requirements for access. Selecting both 'Require device to be marked as compliant' (which leverages Intune's compliance policies) and 'Require terms of use' as grant controls, combined with the 'Require all the selected controls' operator, ensures that users must satisfy both prerequisites simultaneously to gain access to resources. This precisely fulfills the scenario's need for both device compliance and terms of use acceptance.

Microsoft Entra B2B collaboration is the correct solution for securely granting external business partners access to internal resources. This service enables organizations to invite external users, such as partners or vendors, to access specific applications and data within their Microsoft Entra tenant as guest users. It supports various identity providers, allowing partners to use their existing corporate or social credentials for authentication, thereby streamlining access while maintaining strong security controls over the shared resources.

A Microsoft Purview DLP policy scoped to Copilot detects sensitive information types such as credit card and social security numbers in prompts and responses, then blocks the action. This directly prevents Copilot from accessing or generating content containing those data types.

Microsoft Entra External ID is the comprehensive solution specifically designed to manage identities for external users, enabling them to access your applications and resources securely. It supports Business-to-Business (B2B) collaboration for guest users and Business-to-Consumer (B2C) for customer-facing applications, offering features like self-service sign-up, custom branding, and integration with various social and enterprise identity providers.

Passwordless authentication methods, including Windows Hello for Business, FIDO2 security keys, and the Microsoft Authenticator app, are the specific technologies that allow users to sign in without needing to type a password. These methods replace traditional passwords with more secure alternatives, significantly reducing the risk of phishing, credential stuffing, and brute-force attacks. Directly enabling and configuring these options within Microsoft Entra ID is the fundamental step to implement passwordless authentication for an organization's users.

Sensitivity labels, particularly when configured with auto-labeling policies, are specifically designed to automatically classify and apply protection to documents containing sensitive information types. These labels can enforce encryption, visual markings, and access restrictions directly on the content, ensuring data is protected both at rest and in transit, precisely meeting the requirement to automatically classify and encrypt documents.

Enabling Microsoft Entra ID Self-Service Password Reset (SSPR) directly addresses the requirement for users to reset their forgotten passwords without administrator intervention. By configuring the number of authentication methods required to 2, the organization enhances the security of the reset process, ensuring that users provide multiple proofs of identity (e.g., mobile app notification and phone call) before gaining access. This feature is precisely designed for secure, user-initiated password recovery.

This option correctly identifies that the sign-in failure for John Doe, an admin using Azure PowerShell, is likely due to a Conditional Access policy requiring Multi-Factor Authentication (MFA) that the client cannot satisfy. Azure PowerShell, especially older versions or specific cmdlets, may not fully support modern authentication flows required for MFA. Modifying the policy to either exclude this specific application from the MFA requirement or ensuring the client is updated and configured to properly handle MFA challenges would resolve the access issue while maintaining overall security for other access methods.

Microsoft Defender for Cloud Apps provides session controls via Conditional Access App Control, enabling file download blocking and user warning messages for unmanaged devices accessing SaaS apps. This directly satisfies the requirement to monitor and restrict sessions on personal endpoints.

The 'Assume breach' principle is foundational to the Zero Trust security model, asserting that an organization's network and all its components should be treated as if they are already compromised, regardless of their location or previous security posture. This paradigm shift eliminates implicit trust and drives security strategies such as micro-segmentation, continuous monitoring, and robust incident response planning. It directly addresses the question by embodying the core idea that no user, device, or application can be inherently trusted, and therefore, defenses must be built with a breach in mind.

Microsoft Purview retention policies are a core feature of Data Lifecycle Management, enabling organizations to proactively manage content across various locations like Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft 365 Groups. These policies apply retention settings at a broad, container level, ensuring that all content within a specified location is either retained for a minimum period or deleted after a certain time, or both, to meet compliance and regulatory requirements. They are crucial for enforcing consistent data governance across the enterprise.

A Conditional Access policy requiring a compliant device ensures that only devices meeting specific security baselines, as defined and monitored by Microsoft Intune, can access corporate resources. This enforces device health and configuration, ensuring the device adheres to organizational security standards. Microsoft Intune App Protection Policies (MAM) provide a crucial layer of data protection within applications, preventing corporate data from being copied, pasted, or saved to unmanaged applications or personal storage locations, even on unmanaged devices. Together, these policies establish both device-level security posture and application-level data leakage prevention, directly addressing the need to protect data and enforce compliance.

A Suspected Pass-the-Hash (PtH) attack involves an attacker authenticating to a remote system or service by directly using a user's NTLM hash, without ever needing to know the plaintext password. Microsoft Defender for Identity excels at detecting PtH by analyzing NTLM authentication traffic for anomalies, such as a user authenticating from a new source IP address or to a resource without a corresponding Kerberos pre-authentication. This technique bypasses traditional password-based authentication mechanisms, making it a critical threat for MDI to identify.

The Graph filter uses the startsWith operator on userPrincipalName with the value 'j', returning only accounts whose UPN begins with that letter. This is a prefix match, not a contains search, so users with 'j' elsewhere in the UPN are excluded.

Data Loss Prevention (DLP) policies are specifically engineered to inspect content in real-time for sensitive information types (SITs), such as credit card numbers or national ID numbers, across various locations including Exchange Online. When a policy match is detected in an outgoing email, DLP can automatically enforce protective actions like blocking the email, notifying administrators, or applying encryption to prevent unauthorized disclosure of sensitive data in transit. This makes DLP the direct solution for automatically detecting and encrypting emails containing sensitive information.

Microsoft Entra Entitlement Management is a robust identity governance feature that automates the lifecycle of access requests and approvals for internal and external users. It allows organizations to define access packages, which bundle resources and policies, enabling self-service access requests and ensuring users have appropriate permissions based on their role or project. This capability streamlines the process of granting and revoking access, reducing manual overhead and improving security posture.

An anomaly detection policy in Microsoft Defender for Cloud Apps leverages machine learning and behavioral analytics to identify unusual and potentially suspicious activities across your cloud applications. These policies establish a baseline of normal user behavior and then flag deviations, such as impossible travel, sign-ins from unfamiliar locations or IP addresses, and unusual activity volumes. Therefore, it is the correct policy type for detecting and alerting on sign-ins originating from new or previously unseen IP addresses.

Microsoft Defender for Endpoint (MDE) is a unified endpoint security platform that utilizes behavioral analytics, machine learning, and cloud intelligence to detect, investigate, and respond to advanced threats on devices. When a security analyst receives an alert about a suspicious process, MDE's Endpoint Detection and Response (EDR) capabilities automatically collect telemetry, analyze process trees, and can initiate automated investigation playbooks to determine the scope and severity of the threat, isolating the device if necessary. This directly addresses the need to investigate a suspicious process on an endpoint.

The 'mfaEnabledPrincipals' parameter is crucial for this policy's logic, as the 'existenceCondition' relies on it to identify principals who have MFA enabled. If this parameter is not populated with the correct list of MFA-enabled user principal IDs, the policy's 'where' clause cannot accurately determine which principals are compliant. Consequently, the policy will fail to correctly evaluate whether non-MFA-enabled users hold owner role assignments, rendering its compliance assessment ineffective.

Command execution on Azure VMs is captured through Windows Security Events, which include process creation events (such as event ID 4688). Connecting this data source via the Azure Monitor Agent feeds those logs into Microsoft Sentinel, letting a custom analytics rule detect the specific command and raise an incident.

An auto-labeling policy is specifically designed within Microsoft Purview Information Protection to automatically scan content across various locations, such as SharePoint, OneDrive, and Exchange, for predefined conditions. When these conditions, which often include sensitive information types, keywords, or trainable classifiers, are met, the policy automatically applies a specified sensitivity label to the content. This ensures consistent and automated classification and protection without requiring manual user intervention.

Microsoft Entra Conditional Access session controls, when integrated with Defender for Cloud Apps, provides granular, real-time control over user sessions *after* initial authentication. Conditional Access policies can route sessions through Defender for Cloud Apps (formerly MCAS) for continuous monitoring, allowing actions like blocking downloads, requiring re-authentication, or enforcing read-only access based on detected risky behavior *during* the session, not just at sign-in. This combination directly addresses the need for ongoing session control and behavioral enforcement.

Microsoft Purview Data Classification provides the foundational capabilities for identifying, categorizing, and understanding the data within an organization's digital estate. It leverages a robust set of built-in sensitive information types (SITs), named entities, and trainable classifiers to automatically detect specific content patterns, such as credit card numbers, national ID numbers, or industry-specific data. This service is crucial for automatically tagging and labeling data based on its content, forming the basis for subsequent protection and governance actions.

This query correctly identifies users targeting disabled accounts by specifically filtering for `ResultType 50057`, which signifies an account is disabled. By then grouping these events by `UserPrincipalName`, counting the occurrences, and applying a `where count_ > 10` clause within a specified 7-day timeframe, it precisely pinpoints users exceeding the defined threshold of failed attempts against disabled accounts. This is a critical indicator of potential malicious activity or persistent user error.

The Microsoft Purview Data Map is the foundational component of Microsoft Purview, designed to automatically discover, catalog, and classify data assets across an organization's entire data estate, including on-premises, multi-cloud, and SaaS sources. It creates a unified metadata repository, providing a holistic view of data locations, types, and relationships. This capability is essential for understanding data landscapes, enabling data governance, compliance, and risk management initiatives.

Creating an auto-labeling policy for sensitivity labels is the direct and most effective method within Microsoft Purview to automatically classify data based on its content. These policies are specifically engineered to scan content in locations like SharePoint, OneDrive, and Exchange, then apply appropriate sensitivity labels when specific conditions, such as the presence of sensitive information types or trainable classifiers, are met. This automation ensures consistent data classification and the application of associated protective actions without requiring manual user intervention.

Microsoft Defender for Cloud offers unified security management and threat protection across hybrid and multi-cloud environments, including Azure and AWS. It provides Cloud Security Posture Management (CSPM) for continuous assessment of security configurations, offering recommendations to improve posture. Additionally, its Cloud Workload Protection (CWP) features include just-in-time (JIT) VM access, which significantly reduces the attack surface by only opening management ports when needed.

Microsoft Entra External ID is the comprehensive solution for managing and securing identities for external users, including partners, customers, and consultants. It enables organizations to collaborate securely by allowing these external users to sign in with their own identities, such as those from other Microsoft Entra tenants, social identity providers like Google or Facebook, or even via email one-time passcodes. This service specifically facilitates the onboarding and management of external users for resource access without creating full internal accounts.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including Exchange Online emails. These policies use sensitive information types (SITs) to detect content like credit card numbers in real-time as emails are sent. Upon detection, DLP can block the email, notify administrators, and offer users the option to override the block with a business justification, directly preventing unauthorized data egress.

Defender for Office 365 contributes email, collaboration and phishing protection signals into the unified incident queue, so it is one of the three XDR pillars alongside Defender for Endpoint and Defender for Identity. Its alerts feed the correlated incidents the stem requires.

Microsoft Purview Information Protection enables organizations to classify and label sensitive data using sensitivity labels, whether manually or automatically. These labels are crucial as they can be configured to automatically apply specific retention and deletion policies, ensuring data is retained for the required period or disposed of appropriately based on its content and classification. This capability is fundamental for enforcing data compliance requirements by governing data based on its sensitivity.

Microsoft Purview Compliance Manager provides a dynamic compliance score, a quantifiable measure of an organization's progress in meeting data protection and regulatory obligations. This score is calculated based on the completion of improvement actions within assessments. Furthermore, Compliance Manager offers customizable assessment templates, allowing organizations to tailor evaluations to specific internal policies or unique industry regulations not covered by pre-built templates, ensuring comprehensive compliance oversight.

Zero Trust treats identity, encompassing user and device, as the primary security perimeter because authentication and authorisation decisions replace network location. Being inside the corporate network grants no implicit trust, so access is evaluated per request against identity signals.

Self-Service Password Reset (SSPR) is a crucial Microsoft Entra ID feature that empowers users to reset their forgotten or locked-out passwords without requiring administrator assistance. Users authenticate their identity through pre-registered verification methods, such as a mobile app notification, phone call, or personal email, to prove they are legitimate. This capability directly addresses the scenario where a user cannot sign in because they have forgotten their password, allowing them to regain access independently.

Information Barriers in Microsoft 365 are specifically designed to prevent specific groups of users from communicating or collaborating with each other, fulfilling "ethical wall" requirements. Administrators define policies that segment users and restrict interactions in services like Microsoft Teams, SharePoint, and Exchange Online. This directly addresses the firm's need to proactively block communication to ensure compliance and prevent information leakage between sensitive departments.

eDiscovery (Standard) allows creating a case, placing holds on Exchange, SharePoint, and OneDrive locations, and running searches to identify and export relevant content. It preserves data in place and supports the legal hold requirement. This solution directly addresses the need to preserve, search, and export documents across these workloads.

Microsoft Defender for Identity is the dedicated solution for detecting and investigating advanced threats and compromised identities within on-premises Active Directory environments. It deploys lightweight sensors directly on domain controllers to monitor network traffic and Windows events, leveraging behavioral analytics and machine learning to identify suspicious activities. This allows it to detect attack patterns such as lateral movement, credential theft, reconnaissance, and other indicators of compromise targeting on-premises user accounts and domain infrastructure.

Assessments group improvement actions against a specific regulation or standard, letting organisations track progress and assign actions to teams. This satisfies the need to measure movement toward a named standard, whereas the other components do not organise work by regulatory framework.

This option accurately describes the retention label's behavior. The specified retention duration of 2555 days precisely equates to 7 years (2555 days / 365 days/year). Following this 7-year retention period, the 'DeleteAfterRetention' property, which is set to 'true', ensures that the content is automatically and permanently deleted without requiring any manual intervention or disposition review.

Microsoft Defender for Endpoint is the dedicated Endpoint Detection and Response (EDR) solution designed to protect, detect, investigate, and respond to advanced threats on endpoints, including on-premises servers. It provides comprehensive capabilities such as real-time monitoring, behavioral analytics, automated investigation and remediation, and advanced threat hunting tools. This platform is specifically engineered to identify and analyze malware, track its activities, and facilitate a security analyst's investigation into potential compromises directly on the affected machines.

Microsoft Sentinel is a cloud-native SIEM and SOAR platform that ingests signals from Microsoft 365, Defender services and Microsoft Entra ID, correlating them into incidents and automating response with playbooks. This cross-domain visibility satisfies the requirement to detect and respond across email, endpoints and identities.