Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 901–975

The 'Sign-in risk level' condition directly assesses the risk associated with a specific authentication attempt in real-time, leveraging detections from Microsoft Entra ID Protection. An 'Anonymous IP address' is a prominent detection that contributes to a 'High' sign-in risk level, as it often indicates an attempt to obscure the user's true location, which is frequently associated with malicious activity. This condition is precisely designed to respond to such real-time anomalies.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. These policies leverage sensitive information types (SITs) to automatically detect patterns like credit card numbers, social security numbers, or health records. Upon detection, DLP enforces protective actions such as blocking sharing, notifying users, or encrypting content to prevent data exfiltration and ensure compliance.

The query filters SecurityAlert records to the last seven days, then matches alerts whose AlertName contains "MFA". Summarize with count() grouped by bin(TimeGenerated, 1d) aggregates those matches into daily buckets, and render timechart visualises the per-day totals. This satisfies the stem's requirement of counting MFA-related alerts per day.

Conditional access evaluates sign-in conditions before granting access. Configuring the grant control to require multi-factor authentication, scoped to the condition where location is not trusted, enforces MFA only for off-network access while trusted corporate connections proceed without the prompt.

Microsoft Defender for Cloud Apps enforces Conditional Access App Control, a reverse-proxy mechanism that intercepts sessions to sanctioned apps. It applies session policies blocking downloads while permitting read-only access, and provides real-time monitoring. This satisfies the requirement to control unmanaged personal devices without installing agents on them.

PIM provides just-in-time privileged access with approval workflows and time-bound role assignments. Administrators can activate roles only after approval and for a specified duration. This directly meets the requirement for approval and time-bound activations. PIM also provides audit logs and access reviews, enhancing security and compliance for privileged roles.

A sensitivity label with encryption settings supplies the protective action: Azure Information Protection encryption is applied when the label is assigned. This satisfies the stem's requirement to encrypt the document as part of the label, while auto-application to credit card content is handled separately by the other required component.

This statement accurately describes the policy's behavior. The 'RetentionDurationType' is 'ModificationAgeInDays', meaning the the 2557-day (approximately 7 years) period begins from the item's last modification date. Upon reaching this duration, the policy's 'Action' of 'Delete' will be enforced, resulting in the permanent removal of the item.

Data Loss Prevention in Microsoft Purview inspects email and Microsoft Teams content for sensitive information types such as credit card numbers, then blocks the message and shows the sender a policy tip. This directly satisfies the detection, blocking and notification requirements.

An auto-labeling policy for sensitivity labels automatically applies a pre-defined label to content, such as HR documents in SharePoint Online, when specific conditions are met. These conditions often include the detection of sensitive information types like passport numbers or national ID numbers. The applied label can enforce protection actions, including encryption, and can be configured to prevent users from changing or removing the label, ensuring consistent data protection.

Microsoft Entra Verified ID is the dedicated service for implementing decentralized identity and managing verifiable credentials (VCs). It enables organizations to issue digital attestations, such as proof of employment or qualifications, to individuals, who then hold these VCs in a digital wallet. This service facilitates a trust framework where issuers can attest to facts about a user, and verifiers can cryptographically confirm the authenticity of these credentials without relying on a central authority, directly addressing the need for verifiable identity proofs.

Microsoft Defender for Identity is a cloud-based security solution specifically engineered to protect hybrid identity environments, integrating deeply with on-premises Active Directory. It leverages network traffic from domain controllers and Windows events to detect suspicious user and entity behavior, identifying advanced threats like reconnaissance, lateral movement, Golden Ticket attacks, and other identity-based attacks. This service provides crucial visibility and detection capabilities for attacks targeting the core authentication system in a hybrid setup.

Microsoft 365 Defender is the unified XDR (Extended Detection and Response) solution designed to protect an organization's entire digital estate across endpoints, email, identity, and cloud applications. It automatically correlates alerts and incidents from its constituent services (Defender for Endpoint, Office 365, Identity, and Cloud Apps) into a single, comprehensive incident view. This unified perspective is crucial for investigating multi-stage attacks, as it provides a holistic timeline and context across various attack vectors, enabling security operations teams to understand the full scope and impact of sophisticated threats.

Microsoft Purview Data Lifecycle Management (DLM) is specifically engineered to manage the lifecycle of information, including its retention and eventual disposition. DLM utilizes retention labels that can be manually applied or automatically assigned to content based on specific conditions, such as sensitive information types, keywords, or content properties. These labels then enforce retention periods, ensuring data is kept for the required duration and automatically deleted when no longer needed, directly addressing the need for automated retention and deletion policies.

Safe Attachments is a critical component of Microsoft Defender for Office 365 that provides advanced, zero-day protection against unknown malware and viruses in email attachments. It employs a detonation chamber, or sandboxing technology, to open and analyze attachments in a secure, isolated virtual environment. This process determines if an attachment is malicious before it is delivered to the user's inbox, making it the precise solution for scanning email attachments for threats.

Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources. It enables just-in-time (JIT) access, meaning users are assigned privileged roles only when needed and for a limited duration. Requiring approval for role activation ensures an additional layer of control, while access reviews provide periodic verification that users still require their assigned privileges, enforcing the principle of least privilege.

Microsoft Purview Information Protection (MPIP) is a core component for classifying and protecting sensitive data throughout its lifecycle. It enables organizations to define and apply sensitivity labels, which can automatically detect sensitive information types and then apply visual markings, encryption, or access restrictions. This capability directly addresses the need to classify data based on its sensitivity and apply appropriate protective measures.

Intune compliance reflects device health signals reported by the Defender for Endpoint sensor; if onboarding is incomplete, the device cannot attest its risk state, so it falls out of compliance. Verifying sensor onboarding in the Defender portal resolves the misconfiguration shown.

Playbooks in Microsoft Sentinel, powered by Azure Logic Apps, are automated, scalable, and customizable workflows designed to orchestrate and automate incident response tasks. They can be triggered by analytics rules, incidents, or manual actions, performing predefined actions such as enriching incident data, blocking malicious IP addresses, isolating compromised hosts, or notifying security teams via various communication channels. This automation significantly reduces manual effort and accelerates response times.

The PowerShell script utilizes the `New-MgUserAuthenticationPhoneMethod` cmdlet, which is specifically designed to add a new phone authentication method to a specified user's authentication methods in Microsoft Entra ID. This action registers a phone number, making it available for use in scenarios such as SMS-based multifactor authentication or passwordless sign-in, but does not inherently enable MFA itself. It's a foundational step for phone-based authentication.

Conditional Access policies are the primary method in Microsoft Entra ID for enforcing granular access controls, including multi-factor authentication (MFA). They evaluate conditions such as user, device, location, and application to determine if access should be granted, blocked, or require additional authentication methods like MFA, making them highly flexible for enforcing specific security requirements across an organization.

This option accurately describes the combined effect of common DLP policy actions. A Microsoft Purview DLP policy can be configured with multiple actions for a single rule. When BlockAccess is specified, it actively prevents the sharing attempt, ensuring the sensitive information remains within the defined boundaries. Concurrently, the NotifyUser action ensures that the individual attempting the prohibited action receives an immediate notification, explaining why their action was blocked and often providing guidance on compliance.

Auto-labeling for sensitivity labels scans SharePoint content and applies the 'Confidential - Healthcare' label automatically when a document matches the HIPAA pattern, satisfying the requirement to classify PHI without manual intervention. It uses service-side scanning with exact data match or trainable classifiers, unlike client-side labelling or manual application.

Defense in depth is a cybersecurity strategy that employs multiple, overlapping security controls to protect information and systems. This layered approach ensures that if one security mechanism fails or is bypassed, other controls are in place to prevent or detect unauthorized access. The deployment of firewalls and intrusion detection systems, as described, exemplifies this strategy by creating successive barriers against threats.

Sensitivity labels with auto-labelling policies satisfy the automated classification and protection requirement across Exchange Online, SharePoint Online and OneDrive for Business, detecting PHI and PII at scale. Publishing via label policies makes labels available for manual application, meeting the user-driven labelling requirement with minimal manual effort.

Microsoft Purview Information Barriers operate by defining distinct user segments based on specific user attributes and then applying policies to restrict communication and collaboration between these segments. To allow an employee to legitimately communicate and collaborate with others in the 'Traders' segment, their user account must be correctly assigned to that 'Traders' segment. This is typically achieved by updating the relevant user attribute in Microsoft Entra ID that defines the 'Traders' segment, ensuring compliance with the established IB policies.

Microsoft Defender SmartScreen is a security feature integrated into Microsoft Edge and other Windows components that provides real-time protection against phishing sites, malicious websites, and potentially unwanted software downloads. It actively checks websites and files against a dynamic list of reported malicious content, alerting users or blocking access to help prevent them from falling victim to social engineering attacks or malware infections. This direct, browser-level intervention is precisely what's needed to block users from accessing phishing websites.

Cloud Discovery, a core component of Microsoft Defender for Cloud Apps (MDCA), is specifically designed to analyze traffic logs from firewalls, proxies, and other network devices to identify all cloud applications accessed by users. This process enables organizations to gain comprehensive visibility into 'shadow IT' – unsanctioned cloud applications – and assess their associated risks, providing crucial insights into usage patterns across the environment.

Microsoft Purview Audit (Standard and Premium) is specifically designed to capture, retain, and enable searching of user and administrator activities across Microsoft 365 services via the unified audit log. This capability is crucial for security investigations, allowing organizations to identify who performed what action, when, and from where. It provides the necessary historical data to understand the scope and timeline of a security incident, directly addressing the need to investigate security events.

The shared responsibility model correctly defines the split of security tasks between the cloud provider and the customer based on the service model (IaaS, PaaS, SaaS). In this SaaS example, the provider handles infrastructure, and the customer handles data and access.

Data Loss Prevention (DLP) is a core capability of Microsoft Purview, designed to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and on-premises file shares. Purview DLP policies can automatically detect sensitive data types, such as credit card numbers or health records, and then apply protective actions like blocking sharing, encrypting files, or notifying administrators to prevent unauthorized exfiltration or accidental data leaks. This proactive protection is crucial for maintaining compliance and safeguarding organizational data.

Microsoft Defender for Office 365 (MDO) is the correct solution as it provides advanced threat protection specifically for email and collaboration tools like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, scanning them at the time of click to prevent access to malicious websites. Additionally, Safe Attachments sandboxes email attachments to detect and neutralize zero-day malware before it reaches user inboxes, directly addressing concerns about malicious content.

This option correctly assigns the distinct capabilities of each solution. Microsoft Purview Communication Compliance leverages machine learning and predefined or custom policies to proactively detect inappropriate content, including harassment, threats, and discriminatory language, across various communication channels. Concurrently, Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify and prevent the unauthorized sharing or leakage of sensitive information, such as credit card numbers, by applying policies that can block, warn, or encrypt data based on its content and context.

Microsoft Purview Data Loss Prevention (DLP) is specifically designed to automatically detect sensitive information types, such as credit card numbers or national IDs, across various Microsoft 365 services and endpoints. It then enforces policy-driven actions, including blocking email transmission, encrypting files, or notifying administrators, to prevent unauthorized sharing or leakage. This proactive capability directly addresses the requirement to automatically detect and protect sensitive information in real-time by preventing its inappropriate use or transfer.

Microsoft Intune's Mobile Device Management (MDM) capabilities are fundamental for organizations to enroll, configure, and secure a diverse range of corporate and personal devices, including Windows, iOS/iPadOS, Android, and macOS. This core feature enables the enforcement of device-level security policies, deployment of settings and certificates, and remote actions like wiping or locking, ensuring devices meet organizational compliance before accessing sensitive resources.

A Conditional Access policy in Microsoft Entra ID is the robust enforcement mechanism that evaluates various signals, including device compliance status reported by Intune, before granting access to cloud apps like email. It acts as the gatekeeper, allowing administrators to define conditions under which users can access resources. If a device is marked as non-compliant by Intune, a Conditional Access policy can then block access to sensitive applications, effectively linking device health to resource access.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is explicitly designed to ingest security logs from diverse sources, including on-premises servers, network devices, and cloud services, through various data connectors like the Log Analytics agent. This centralized collection is fundamental for comprehensive threat detection, investigation, and automated response across hybrid environments.

Conditional Access evaluates signals such as device compliance state from Microsoft Intune and enforces grant controls, so only compliant, encrypted, patched devices reach Exchange Online. This satisfies the requirement to block non-compliant devices from corporate email at authentication time.

This policy type in Microsoft Purview is specifically designed to automatically apply sensitivity labels to content at scale, both at rest and in transit. It leverages conditions based on sensitive information types, keywords, or trainable classifiers to identify specific content patterns, ensuring consistent classification and protection without manual intervention. This directly fulfills the requirement for automatic data management.

Conditional Access policies are the primary mechanism in Azure AD for enforcing specific access controls based on various conditions, including user attributes, device state, location, and client applications. To effectively block legacy authentication, a Conditional Access policy can be configured to target 'Other clients' or 'Exchange ActiveSync clients' and then apply a 'Block access' grant control. This prevents older protocols such as POP, IMAP, and SMTP from authenticating, thereby mitigating associated security risks by forcing the use of modern authentication.

Microsoft Defender for Office 365, a core component of Microsoft Defender XDR, includes Safe Attachments, which proactively scans email attachments. This capability detonates attachments in a virtual sandbox environment to analyze their behavior for malicious content before they are delivered to the user's inbox, effectively preventing zero-day malware and advanced threats from reaching endpoints.

A retention label configured for regulatory records locks content so it cannot be deleted or modified, even by administrators, and records the declaration in the audit log, satisfying the requirement that high-value records remain undeletable.

Placing relevant sites on litigation hold, also known as an eDiscovery hold, is the precise and legally recognized mechanism within Microsoft Purview to preserve electronically stored information (ESI) indefinitely for legal or investigative purposes. This action overrides all existing retention policies and user deletion actions, ensuring that all content, including documents, emails, and versions, remains immutable and discoverable for the entire duration of the legal matter, regardless of any other retention settings.

For a Conditional Access policy to effectively target and block specific client application types, such as "Exchange ActiveSync clients" or "Other clients" (which often represent legacy authentication protocols), the `ClientAppTypes` condition must be explicitly configured. If this condition is empty or not selected, the policy will not apply to any particular client application type, thus failing to block legacy authentication attempts originating from those specific clients.

SMS-based authentication in Azure AD allows users to sign in to cloud applications by entering their registered phone number instead of a traditional username and password. Upon entering the phone number, a one-time passcode (OTP) is sent via SMS to that number, which the user then enters to complete authentication. This method provides a convenient, passwordless experience, directly leveraging the ubiquity of mobile phones and SMS for identity verification and fulfilling the requirement to sign in using a phone number.

Within Microsoft Entra Permissions Management, the Activity trail component meticulously records all user and resource actions performed across connected cloud environments, including AWS, Azure, and GCP. This comprehensive log details who accessed what resource, when, and how, providing critical visibility into the actual usage of granted permissions. It is essential for detecting anomalous behavior, identifying potential misuse of entitlements, and understanding the real-world impact of permission policies.

Employee IDs follow the fixed pattern EMP- followed by five digits, so a regular expression defines that structure precisely. Rule pack elements such as keywords or dictionaries cannot match positional digit patterns; the regex element supplies the pattern-matching logic Microsoft Purview requires for this custom sensitive information type.

Microsoft Entra ID Identity Protection actively monitors and analyzes sign-in attempts and user behavior to identify potential threats. This capability includes detecting various anomalies, such as sign-ins from anonymous IP addresses, unfamiliar locations, or impossible travel scenarios, which are strong indicators of compromised credentials or malicious activity. It continuously assesses risk levels for each identity.

Microsoft Defender for Office 365 is specifically engineered to protect against advanced threats in email and collaboration services like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, then scans them at the time of click to prevent users from accessing malicious websites. Additionally, Safe Attachments sandboxes suspicious attachments, ensuring comprehensive protection against phishing and malware delivered via email.

Records Management applies retention labels declaring documents as records for the ten-year period after case closure, preventing alteration or premature deletion. Data Lifecycle Management handles the separate 30-day draft deletion, so combining both satisfies the distinct retention requirements.

Installing a sensor on a domain controller is the correct action for deploying Microsoft Defender for Identity. The Defender for Identity sensor passively monitors network traffic to and from the domain controller, as well as Windows events directly from the domain controller itself. This strategic placement allows it to detect suspicious activities, lateral movement paths, and advanced persistent threats targeting Active Directory, providing critical insights into identity-based attacks.

Auto-apply retention label policies can automatically apply a retention label to content that matches specific conditions, such as containing a sensitive information type like SWIFT Code. This allows the organization to retain documents for seven years and then delete them without manual intervention. This feature is designed exactly for this scenario, making it the correct choice.

Phone call (voice call) is a supported multi-factor authentication method where Microsoft Entra ID initiates an automated voice call to a user's registered phone number. To complete authentication, the user must answer the incoming call and typically press a specific key, such as the # key, on their phone's keypad to confirm their identity. This directly fulfills the requirement of a phone call for user verification.

Microsoft 365 Communication Compliance is specifically designed to proactively detect, investigate, and remediate policy violations within an organization's communications, including Microsoft Teams chats. It leverages machine learning to identify sensitive information, regulatory compliance issues, or inappropriate conduct based on customizable policies. This tool enables organizations to monitor ongoing conversations for potential risks and take corrective actions before they escalate.

Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content based on predefined conditions, such as the presence of specific sensitive information types, keywords, or patterns. These policies can be configured to apply labels to files at rest in SharePoint and OneDrive, or to emails and documents in Exchange, ensuring consistent classification without manual intervention. This direct application of labels fulfills the requirement for automatically classifying highly confidential information.

Microsoft Entra Conditional Access policies are the primary mechanism for enforcing access controls based on specific conditions, such as user location, device state, or application being accessed. By defining a policy that targets all users and requires MFA, an administrator can then create an exception for trusted IP ranges, effectively bypassing MFA when users are on the corporate network. This granular control over access based on real-time signals is central to Microsoft Entra ID P2 security capabilities.

The "Block with user notification" action is a robust enforcement mechanism that actively prevents the sharing of sensitive information, such as blocking an email from being sent or a file from being shared. Simultaneously, it displays a policy tip to the end-user, clearly informing them why the action was blocked and providing guidance on how to comply with organizational policies or remediate the issue. This combination effectively enforces data protection while educating users on acceptable data handling practices.

Digital signatures achieve non-repudiation by cryptographically binding a sender's identity to a message. The sender uses their unique private key to sign a hash of the document, creating a verifiable digital fingerprint. This signature, which can be validated by anyone with the sender's corresponding public key, provides irrefutable proof of origin and consent, ensuring the sender cannot legitimately deny having sent the message or performed the action.

Microsoft Defender for Office 365 is the correct solution because it provides advanced protection against sophisticated email and collaboration threats, including phishing, business email compromise, and malware delivered via email, Microsoft Teams, SharePoint, and OneDrive. It utilizes capabilities like Safe Attachments and Safe Links to scan content in real-time and includes automated investigation and response (AIR) for email-borne attacks, directly addressing the need to protect against email threats.

Implementing security recommendations by remediating unhealthy resources is the most direct and effective method for improving Microsoft Defender for Cloud's Secure Score. The Secure Score is a quantitative measurement derived from the successful completion of security recommendations across various controls. By actively addressing and resolving identified vulnerabilities, misconfigurations, and compliance gaps on resources flagged as "unhealthy," organizations directly fulfill the criteria for these controls, thereby increasing their overall security posture and elevating the Secure Score.

A sensitivity label, once created and configured, must be explicitly published through a label policy to become active and available for users or automatic application. Without being included in a policy and assigned to specific users or groups, the label remains in a draft state and cannot be applied, either manually or automatically, to documents or emails. This publishing step is critical for the label's operational deployment and is the most common reason for a configured label not being applied.

Enabling password hash synchronization in Microsoft Entra Connect is correct because it allows Microsoft Defender for Identity to analyze NTLM hashes and detect pass-the-hash attacks.

The Microsoft Defender XDR portal, accessible at security.microsoft.com, is the centralized console for managing and responding to threats across an organization's entire digital estate. It provides a unified security dashboard by integrating signals from Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps. This comprehensive view enables security analysts to correlate alerts, investigate incidents, and automate responses, making it the ideal solution for a unified security experience within Microsoft 365 E5.

Microsoft Purview Audit (Premium) is the correct solution because it provides advanced auditing capabilities specifically designed to capture and retain detailed user and admin activities across Microsoft 365 services. It offers extended retention of audit logs for up to one year (or 10 years with an add-on license) and access to crucial audit events like file and folder activities, enabling organizations to perform forensic investigations, respond to regulatory requests, and proactively monitor changes to sensitive files with high fidelity.

Microsoft Defender for Cloud delivers continuous secure score posture assessment, a regulatory compliance dashboard covering NIST SP 800-53, and Defender plans providing hybrid threat detection such as SSH brute force alerts. It satisfies all three stem requirements across Azure VMs and on-premises Windows servers from one solution.

A KQL query that aggregates and counts EventID 4625 (failed login attempts) for individual user accounts within a specific timeframe is highly effective for detecting potential brute-force attacks. A significantly elevated number of failed login attempts against a single account or a small set of accounts strongly indicates an attacker systematically trying multiple password combinations. This pattern is a hallmark of brute-force activity.

Microsoft Defender for Endpoint is purpose-built for comprehensive endpoint security, offering advanced capabilities like Endpoint Detection and Response (EDR), vulnerability management, and automated investigation and remediation. It provides security operations teams with the tools to proactively hunt for threats across Windows devices, respond to incidents, and maintain a strong security posture against sophisticated cyberattacks, directly addressing the need for device protection and threat hunting.

Microsoft Purview DLP policies offer granular control, allowing administrators to define distinct policies for different service locations. By creating one policy specifically scoped to Exchange Online with a "block" action and a separate policy for Microsoft Teams with an "audit-only" action, the company can precisely meet the requirement. This approach leverages DLP's ability to apply varied enforcement levels based on the communication channel, ensuring sensitive data is protected appropriately in each context.

The 'Verify explicitly' principle is a cornerstone of the Zero Trust model, mandating that every access request to any resource must be fully authenticated, authorized, and validated based on all available contextual signals. This includes user identity, device health, location, service, and data classification, ensuring no implicit trust is ever granted. It requires continuous, real-time evaluation before granting access, regardless of whether the request originates inside or outside the traditional network perimeter.

Microsoft Entra Application Proxy is the correct solution for securely publishing on-premises web applications to external users. It achieves this by deploying a lightweight connector within the on-premises network, which establishes an outbound connection to Azure, creating a secure tunnel. This allows users to access internal web apps remotely with single sign-on capabilities, leveraging Entra ID's conditional access policies without requiring a VPN or opening inbound firewall ports.

This is the fundamental and most direct method to control which users or groups are authorized to access a specific enterprise application in Microsoft Entra ID. By assigning a group like 'SalesTeam' to the CRM application, you explicitly provision access for all members of that group, ensuring only authorized individuals can sign in and utilize the application. This method establishes the baseline access permissions for the application.

Microsoft Entra B2B (Business-to-Business) collaboration is the appropriate solution for enabling partner users to access applications and resources within your organization using their existing corporate or social identities. This feature creates guest user objects in your directory, allowing external users to authenticate with their home identity provider while granting them controlled access to your Microsoft Entra ID-protected resources without requiring complex federation setup.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information such as credit card numbers across various locations. A DLP policy can be precisely configured to detect this sensitive data within documents and then automatically enforce actions like blocking external sharing. Furthermore, it can provide immediate, user-facing policy tips to educate individuals about the policy violation, making it the ideal solution for both prevention and user notification.

Microsoft Purview Data Estate Insights provides a comprehensive, high-level view of an organization's entire data landscape, including data sources like Azure SQL. It offers pre-built reports and metrics that highlight data classification, sensitivity label distribution, data ownership, and glossary adherence across the data estate. This enables organizations to monitor and demonstrate compliance with data privacy regulations by understanding where sensitive data resides and how it's governed.

Microsoft Defender for Office 365 is specifically engineered to protect an organization from sophisticated threats in email, links, and collaboration tools like Microsoft Teams. It leverages advanced anti-phishing, anti-malware, and Safe Attachments/Safe Links technologies to detect and block threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate alerts, determine the scope of a threat, and take recommended or approved remediation actions for email-borne attacks, directly addressing the requirement.