Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 226–300

Sensitivity labels with auto-labelling classify and protect personal data across SharePoint Online and OneDrive for Business, while DLP blocks accidental sharing through email and Teams. eDiscovery handles DSR access and deletion, Data Lifecycle Management applies differing retention periods, and Audit (Premium) retains the one-year activity trail.

The 'Verify explicitly' principle is central to Zero Trust, requiring that all access requests are authenticated and authorized based on all available data points, rather than granting implicit trust. This includes evaluating user identity, device health, location, service, data classification, and potential anomalies continuously. It directly challenges traditional security models by explicitly rejecting the notion that network location alone can confer trustworthiness for any resource access.

Microsoft Purview eDiscovery solutions are specifically designed to enable organizations to identify, preserve, collect, process, review, and produce electronically stored information (ESI) in response to legal or regulatory requests. It provides advanced search capabilities across diverse data sources, allows for placing immutable legal holds to prevent data alteration, and facilitates the secure export of relevant data for legal proceedings. This functionality directly addresses the need to search for specific emails and manage them for litigation purposes.

Microsoft Secure Score is a robust measurement tool within the Microsoft 365 Defender portal designed to help organizations understand and improve their security posture. It aggregates security configurations and behaviors across various Microsoft services, providing a numerical score and actionable recommendations. These recommendations guide administrators in implementing best practices and mitigating risks, thereby enhancing overall tenant security over time.

Microsoft Purview Data Lifecycle Management is the correct solution because it provides robust auto-labeling policies specifically designed for applying retention labels. These policies leverage sensitive information types, keywords, or trainable classifiers to automatically detect and apply appropriate retention labels to content across Microsoft 365 services like SharePoint, OneDrive, and Exchange. This ensures that data is retained or deleted according to organizational policies without requiring manual intervention, streamlining compliance efforts.

For an Azure Infrastructure as a Service (IaaS) virtual machine, the customer retains full responsibility for managing and securing the guest operating system. This critical duty includes regularly applying security updates, patches, and hotfixes to the OS (e.g., Windows Server, Linux distributions) to mitigate vulnerabilities. Microsoft provides the underlying infrastructure, but the customer must actively maintain the OS's security posture, including anti-malware and firewall configurations.

The policy's grant control explicitly states 'Require multi-factor authentication,' which means users must successfully complete an MFA challenge to gain access. When combined with a condition that specifies access to Office 365 from 'trusted locations,' this policy ensures enhanced security even from known network perimeters. It mandates an additional layer of identity verification for these specific access attempts. This configuration aligns perfectly with the principle of least privilege and Zero Trust.

Automated investigation and response in Defender for Office 365 automatically investigates email threats such as phishing and malware, and applies remediation like soft delete or move to junk. In Microsoft Defender XDR, these investigations correlate with endpoint and identity signals to provide a unified view. Configuring it meets the need for automatic email threat remediation with cross-domain correlation.

Microsoft Defender for Office 365 is a crucial component of Microsoft Defender XDR, specializing in protecting an organization's email, collaboration tools, and data within the Office 365 suite. It provides advanced protection against phishing, business email compromise (BEC), malware, and other sophisticated threats targeting email and cloud applications like SharePoint, OneDrive, and Teams. By integrating these signals, it enables a unified security response across the entire digital estate.

The Microsoft 365 Defender portal (security.microsoft.com) is the centralized management console for the Microsoft 365 Defender suite. It provides a unified XDR (eXtended Detection and Response) experience, correlating signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This integration enables security teams to investigate and respond to sophisticated multi-stage attacks across endpoints, email, identities, and applications from a single pane of glass, streamlining incident management.

App control policies, such as Windows Defender Application Control (WDAC) or AppLocker, are specifically designed to restrict which applications can run on devices. These policies enforce a strict allowlist or blocklist, preventing the execution of unauthorized software, including user-installed applications. By defining trusted applications based on publisher, path, or hash, they directly address the requirement to block unapproved installations and executions, ensuring a secure software environment.

Microsoft Defender for Identity (MDI) is specifically engineered to protect hybrid identity environments by monitoring on-premises Active Directory. It deploys lightweight sensors directly on domain controllers, which passively analyze network traffic and Windows events to detect suspicious user and entity behavior, including advanced attacks like pass-the-hash, Kerberos attacks, and Golden Ticket exploits. MDI provides real-time threat detection and security alerts, making it the ideal solution for securing on-premises AD from sophisticated identity-based threats.

An endpoint protection configuration profile in Intune enforces BitLocker encryption settings directly on devices, satisfying the requirement to enable BitLocker automatically rather than merely detecting its state. Compliance policies only report against conditions; they cannot remediate. The configuration profile therefore closes the gap causing non-compliance reports.

Session control is a core capability of Microsoft Defender for Cloud Apps, leveraging a reverse proxy architecture to provide real-time monitoring and enforcement of policies during user sessions. This allows organizations to prevent data exfiltration, block specific activities like downloads or uploads of sensitive information, and enforce step-up authentication within sanctioned cloud applications, even when users access them from unmanaged devices.

Microsoft Purview Compliance Manager is designed to help organizations assess and manage their compliance with various regulatory standards, including HIPAA. It provides a compliance score, detailed assessment templates, and recommended improvement actions to help meet compliance requirements. This directly addresses the need to evaluate and enhance the organization's compliance posture for HIPAA.

Microsoft Purview Data Lifecycle Management (DLM) is a compliance solution designed to govern information throughout its entire lifecycle. It enables organizations to define and apply retention labels and policies to content across Microsoft 365 services, ensuring that data is kept for necessary periods and then defensibly deleted when no longer required, aligning with regulatory and business obligations.

The policy targets all guest and external users and all cloud apps, with MFA as the grant control. Every external user sign-in to any cloud application must therefore complete multi-factor authentication, satisfying the stated assignment and access control configuration.

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing content retention and deletion throughout its lifecycle. It enables organizations to create and apply retention policies that automatically preserve content for specified periods to meet regulatory, legal, or business obligations. Once the retention period expires, DLM ensures the content is permanently deleted, thereby addressing the question's requirement for mandated retention and eventual disposal.

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within Azure AD, Azure, and other Microsoft online services. It enforces just-in-time (JIT) access, allowing users to activate privileged roles only when needed and for a limited duration. This capability significantly reduces the attack surface by eliminating standing administrative access, requiring explicit activation and often approval workflows for elevated permissions.

Microsoft Entra B2B collaboration allows external partners to access applications using their own credentials. It supports the configuration of a terms of use agreement that partners must accept before accessing the application. This satisfies both requirements: using own corporate credentials and accepting terms of use.

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) provides robust session controls, a critical capability for real-time monitoring and governance of user activities within cloud applications. These controls enable organizations to enforce policies during a user session, such as blocking sensitive data downloads, requiring justification for specific actions, or protecting data with encryption, while maintaining full visibility into user interactions.

Reviewing the account's activity timeline in Microsoft Defender for Identity surfaces every login and accessed resource tied to the service account, directly addressing the lateral movement alert. This satisfies the need to establish whether the account was used across multiple servers from a non-domain-joined machine, confirming compromise before remediation.

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for automatically detecting documents and managing their retention and deletion. DLM utilizes retention labels and policies that can be automatically applied to content based on specific conditions, such as sensitive information types or keywords. These policies ensure that documents are retained for required periods and then disposed of according to compliance regulations, including managing holds for legal discovery and disposition reviews.

The retention policy scopes HR department content in Exchange and SharePoint, retaining items for 365 days before deletion. This matches the configured retention period and locations, so content is preserved for the full duration and then removed automatically.

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) capabilities. It offers advanced threat protection specifically for Azure PaaS services like Azure SQL Database, Azure Key Vault, and Azure Storage accounts. This includes continuous monitoring, vulnerability assessments, and real-time threat detection alerts tailored to the unique attack vectors of these services, ensuring robust security for cloud-native applications.

This statement is correct because a Conditional Access policy configured to "include" trusted locations in its `locations` condition will apply its grant controls, such as requiring multi-factor authentication (MFA), even when users are signing in from designated secure network segments. For most MFA policies, the best practice is to *exclude* trusted locations to provide a frictionless experience for users on corporate networks, making the inclusion of trusted locations an often misconfigured or overly restrictive setting.

Microsoft Purview Communication Compliance is specifically engineered to proactively detect and remediate regulatory compliance risks, such as market abuse, insider trading, and harassment, within an organization's electronic communications. It leverages machine learning and policy-based scanning across platforms like Microsoft Teams, Exchange, and Yammer to identify potential violations. Financial services companies rely on this capability to meet stringent industry regulations by reviewing flagged messages and taking appropriate action, ensuring adherence to standards like FINRA or SEC rules.

Microsoft Purview Insider Risk Management proactively identifies and mitigates potential data security risks originating from within an organization. It leverages machine learning to analyze user activity across various signals (e.g., file access, email, Teams, SharePoint) to establish behavioral baselines. By detecting deviations from these baselines and correlating multiple anomalous events, it uncovers patterns indicative of data theft, intellectual property leakage, or policy violations, whether malicious or inadvertent.

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing the retention and deletion of data across an organization's Microsoft 365 environment. It allows administrators to create and apply retention policies and labels that automatically retain content for specified periods or delete it after a certain time or event. DLM ensures that data is kept for legal, regulatory, or business requirements and then defensibly disposed of when no longer needed, directly addressing retention and deletion needs.

Configuring Microsoft Entra ID Protection user risk policies directly fulfills all requirements by leveraging machine learning to detect anomalous user behavior and assign a risk level. A policy can be set to automatically block access for users deemed high risk, preventing potential breaches. Concurrently, another policy can enforce a password change for users with medium risk, proactively mitigating credential compromise. Enabling risk reporting ensures ongoing visibility and auditing of these security events.

Microsoft Entra ID Access Reviews are specifically designed to manage and streamline the periodic review of user access to resources like groups, applications, and roles. Administrators can configure recurring reviews, assign reviewers (e.g., resource owners, managers), and set up automated actions, such as removing access for users whose access is not approved or if the reviewer fails to respond within a specified timeframe. This capability directly addresses the need for periodic recertification and automated removal.

When a document is marked with a regulatory record label in Microsoft Purview, it becomes immutable to meet stringent compliance requirements. This means the content is locked down, preventing any user from editing or deleting it, regardless of their assigned permissions. This highest level of restriction ensures the integrity and non-repudiation of the record throughout its defined retention period.

Microsoft Defender for Cloud offers just-in-time (JIT) virtual machine access as a core security capability. This feature significantly reduces the attack surface by locking down inbound traffic to your Azure VMs, only opening necessary ports for a limited, configurable time when a user explicitly requests access. This ephemeral access is granted only after a successful authentication and, optionally, multi-factor authentication, ensuring that VMs are exposed to the internet only when actively needed.

Microsoft Defender XDR is the correct solution because it provides extended detection and response capabilities across multiple security domains. It unifies protection, detection, and response by automatically correlating alerts from identities (Defender for Identity), endpoints (Defender for Endpoint), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps). This integrated approach enables security teams to conduct centralized investigations into complex, multi-stage attacks within a single portal, significantly improving incident response efficiency.

Microsoft Purview Information Protection (MIP) is the correct solution because it provides the comprehensive capabilities necessary for data classification and protection, crucial for HIPAA compliance. It enables organizations to discover, classify, and label sensitive data, such as Protected Health Information (PHI), using automated or manual methods. These sensitivity labels can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring PHI is safeguarded throughout its lifecycle.

Microsoft Defender for Identity (MDI) is specifically designed to protect hybrid identity environments by monitoring Active Directory domain controllers and other identity infrastructure. It identifies, detects, and investigates advanced threats, compromised identities, and malicious insider actions directed at an organization's identity system. Therefore, an alert within Microsoft Defender XDR concerning identity-based attacks or suspicious authentication activities would originate directly from MDI's specialized detection capabilities.

Scheduled query analytics rules are the foundational method in Microsoft Sentinel for creating highly customizable detection logic using Kusto Query Language (KQL). They allow security analysts to define complex queries, perform aggregations, apply advanced filtering, and set precise threshold conditions over specified time ranges to identify specific threats and generate incidents based on unique organizational requirements.

Microsoft Defender for Cloud Apps (MDCAS) acts as a Cloud Access Security Broker (CASB), providing real-time session control over cloud applications. By implementing an MDCAS session policy with app control, traffic between the user and the third-party SaaS application is proxied, allowing for granular actions such as blocking file downloads while simultaneously permitting read-only access. This capability precisely addresses the requirement to allow users to view content but prevent data exfiltration through downloads, often based on contextual factors like device state or user group.

Microsoft Purview eDiscovery (Standard) is specifically designed to address legal and investigative requirements by enabling organizations to identify, preserve, collect, and export electronically stored information (ESI). It allows legal teams to place immutable legal holds on content across Microsoft 365 services like Exchange, SharePoint, OneDrive, and Teams, preventing modification or deletion. Furthermore, it provides robust content search capabilities and the ability to export collected items in a defensible manner for external review, directly supporting the needs of a lawsuit.

Live response in Microsoft Defender for Endpoint provides security analysts with immediate remote access to an endpoint using a secure shell connection. This capability allows investigators to run commands, collect forensic data such as files, registry keys, and process information in real-time, and take immediate remediation actions directly on the compromised device. It is specifically designed for interactive, on-demand data acquisition and incident response, making it the correct tool for collecting real-time data.

For a virtual machine deployed on Azure IaaS, the customer retains full responsibility for managing the guest operating system, including all necessary security updates, patches, and configurations. This also extends to any applications installed within that OS, such as web servers or databases. Unlike PaaS or SaaS, where the provider handles these updates, IaaS requires the customer to actively maintain the software stack running inside their virtual machines to ensure security and performance.

Microsoft Entra External Identities is the comprehensive set of capabilities that allows organizations to manage all external users, including customers, partners, and citizens. It specifically supports enabling sign-in for consumers using social identity providers like Google, Facebook, and Microsoft accounts, as well as enterprise identity providers, allowing them to access applications and resources securely. This feature is crucial for scenarios requiring consumer-facing applications where users bring their own social identities.

Confidentiality is the fundamental security principle ensuring that sensitive information, such as patient records, is protected from unauthorized disclosure and access. Encryption directly supports confidentiality by rendering data unreadable to anyone without the correct decryption key, even if they gain access to the encrypted files. This mechanism, combined with robust access controls, ensures that only authorized individuals can view or process the confidential patient data.

Conditional Access policies in Microsoft Entra ID serve as the enforcement engine that evaluates various signals, including the device compliance status reported by Intune, to make real-time access decisions for cloud applications. Conditional Access policies can be configured to explicitly require a device to be marked as "compliant" by Intune before allowing access to sensitive organizational resources, thereby linking device health directly to identity-based access control. They are the critical component for enforcing device compliance for cloud app access.

This option accurately describes a common configuration in Azure AD entitlement management access packages. A policy configured for "users in your directory" typically allows all internal members to request access. Furthermore, entitlement management policies offer granular control to specify different approval requirements, such as mandating manager approval specifically for guest users, while internal users might have a different or no approval flow. This balances self-service with necessary oversight for external collaborators.

Microsoft Sentinel is a scalable, cloud-native SIEM and SOAR that can ingest logs from on-premises, Azure, AWS, GCP, and many other sources. It provides threat detection and automated response via playbooks, making it the correct solution for the described need.

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing deep visibility and control over cloud applications. Through its Conditional Access App Control capabilities, it can proxy user sessions to third-party SaaS CRM applications in real-time. This allows for granular policy enforcement, such as blocking downloads of sensitive data to unmanaged devices, directly within the user's session, effectively preventing data loss.

Self-Service Password Reset (SSPR) allows users to reset their forgotten password without administrator intervention, directly addressing the user's inability to access Microsoft 365 services due to password loss. SSPR operates through Microsoft Entra ID's authentication methods—such as security questions, phone verification, or email verification—to verify identity before permitting a reset, satisfying the constraint that the user cannot authenticate via their forgotten password.

Microsoft Entra Identity Protection is purpose-built to detect and automatically remediate identity-based risks, including sophisticated password spray attacks. It utilizes machine learning and behavioral analytics to identify anomalous sign-in patterns, such as sign-ins from unfamiliar locations, impossible travel, or multiple failed attempts across various accounts from a suspicious IP address. Based on these risk detections, Identity Protection can enforce conditional access policies to block or challenge risky sign-ins, effectively preventing unauthorized access.

Conditional Access evaluates sign-in conditions and can enforce a block for legacy authentication clients, which cannot perform modern interactive authentication or MFA. This directly satisfies the requirement to block legacy protocol sign-ins, since the policy targets those client types at authentication time.

Microsoft Purview Audit (Standard or Premium) is the correct service for generating reports on user and administrator activities across Microsoft 365 services. It captures a comprehensive record of events, such as file access, mailbox activities, and system configuration changes, which are crucial for forensic investigations, regulatory compliance, and internal policy adherence. The unified audit log allows compliance administrators to search, filter, and export these activity records to demonstrate compliance with various regulations.

Microsoft Entra Permissions Management, a Cloud Infrastructure Entitlement Management (CIEM) solution, provides comprehensive visibility and control over permissions across multi-cloud environments, including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It enables organizations to discover, remediate, and continuously monitor permissions, identifying and right-sizing over-privileged identities to enforce the principle of least privilege. This directly addresses the need for multi-cloud permissions visibility and automated remediation.

Microsoft Purview Audit (Standard) is specifically designed to capture and log user activities across Microsoft 365 services, including SharePoint Online. This capability allows security administrators to efficiently search the unified audit log for specific events, such as a user accessing, viewing, or downloading a sensitive file, making it an appropriate and primary tool for investigating potential data breaches or unauthorized access incidents.

Conditional Access policies provide granular control over access to specific cloud applications based on various conditions, such as user location, device state, or sign-in risk. An administrator could have configured a policy specifically targeting the HR application to block access under certain circumstances, while allowing access to other applications that are not subject to the same restrictive policy. This targeted enforcement is a core capability of Conditional Access and aligns perfectly with the observed behavior.

Retention label retains for 10 years; sensitivity label provides encryption and header; conditional access restricts by region.

The Shared Responsibility Model defines which security controls Azure always retains — physical datacentre, host infrastructure, network — and which transfer to the customer, such as data, identities and access management, satisfying the CISO's need for a clear division.

Microsoft Entra External ID is the comprehensive solution for managing external identities and providing them secure access to your organization's applications and resources. It enables business-to-business (B2B) collaboration, allowing partners to use their existing corporate or social identities (e.g., Microsoft accounts, Google, federated SAML/WS-Fed providers) to sign in. This feature integrates external users directly into your Microsoft Entra tenant, facilitating seamless collaboration while maintaining administrative control over their access permissions.

Microsoft Entra Permissions Management is a cloud infrastructure entitlement management component of the Microsoft Entra family, satisfying the stem's product-family criterion. It discovers, remediates and monitors permissions across AWS, Azure and Google Cloud, unlike Microsoft Entra ID Governance or Verified ID, which address identity lifecycle and verification.

Microsoft Defender for Office 365 provides Safe Attachments and Safe Links, which detonate and analyse email attachments and rewrite URLs for click-time verification, directly satisfying the requirement to detect malicious content and block access after delivery.

A Communication Compliance policy is specifically engineered within Microsoft Purview to detect, investigate, and remediate inappropriate messages across various Microsoft 365 communication channels, including Microsoft Teams, Exchange email, and Viva Engage. These policies leverage machine learning, keyword dictionaries, and trainable classifiers to identify content related to harassment, threats, sensitive information sharing, or regulatory violations. It provides a robust framework for organizations to proactively manage and mitigate communication risks, directly addressing the need to monitor for inappropriate messages.

Microsoft Sentinel Analytics rules are the core mechanism for proactively detecting threats and generating incidents by correlating events across connected data sources. These rules leverage Kusto Query Language (KQL) to define specific patterns, behaviors, or anomalies that indicate malicious activity, executing on a scheduled basis to identify threats that might otherwise go unnoticed. They are specifically designed to perform the continuous event correlation required for automated threat detection and alerting.

A retention policy can target Exchange Online and include a keyword query condition to match messages containing 'Project Falcon'. It applies automatically at the service level, retains matching items for seven years, and then deletes them, without requiring user-applied labels. This directly satisfies the requirement for automatic, centralized retention.

A static retention policy applies to all content within specified locations (e.g., an entire SharePoint site or all Exchange mailboxes) uniformly. While it defines a retention duration, it does not dynamically calculate the retention start date for each individual item based on its unique 'last modified' property. Instead, its retention start is often tied to the content's creation date or the policy's application, making it unsuitable for granular, item-specific 'last modified' based retention.

Microsoft Defender for Endpoint is the primary Endpoint Detection and Response (EDR) solution within the Microsoft 365 Defender suite, specifically designed for device-level protection. It includes robust Automated Investigation and Remediation (AIR) capabilities that leverage AI and machine learning to automatically analyze alerts, correlate events, and take immediate actions such as isolating devices, stopping processes, or quarantining files upon detection of a threat. These capabilities are fundamental for rapid incident response directly on the endpoint.

The alert is already generated in Defender for Endpoint, so the administrator opens it in the Microsoft Defender XDR portal to review evidence, affected devices and related incidents, then decide on response actions. Investigation precedes remediation, satisfying the requirement to investigate the high-severity new alert.

For most enterprise applications configured with Microsoft Entra ID for single sign-on, explicit user or group assignment is a mandatory authorization step. If a user is not assigned to the application, Microsoft Entra ID will deny access even if their authentication credentials are valid, preventing them from reaching the SaaS application.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution. It provides centralized security data collection from various sources, including users, applications, servers, and network devices, across an organization's entire digital estate. Sentinel then uses advanced analytics and threat intelligence to detect, investigate, and respond to threats by correlating these events in real-time. This capability is fundamental to its role in modern security operations.

Scheduled query rules are the appropriate choice for correlating events over a specific time window, such as 24 hours. These rules allow security analysts to write custom Kusto Query Language (KQL) queries that can join multiple data sources, apply complex logic, and identify specific patterns or sequences of events. They can be configured to run at defined intervals (e.g., daily) and look back over a specified period, making them ideal for long-duration correlation and custom threat detection scenarios.

Trainable classifiers are machine learning-based solutions in Microsoft Purview that enable organizations to identify and classify custom content types by learning from example documents. Administrators provide positive and negative examples, allowing the classifier to recognize specific categories of information, such as legal contracts or project specifications, that cannot be easily defined by simple patterns. This adaptive approach is ideal for nuanced document classification where the content's meaning, rather than just specific keywords or patterns, determines its category.

The unfamiliarFeatures detection flags sign-in properties that deviate from the user's learned baseline, such as a new location, device or network. Medium risk at IP 203.0.113.5 indicates behaviour outside John Doe's normal pattern rather than confirmed credential compromise.

Microsoft Entra External ID, formerly Azure AD B2C, is specifically designed to manage customer-facing applications and enable users to sign in using various identity providers, including social accounts like Google, Facebook, and Microsoft accounts. It provides robust capabilities for user flows, custom branding, and integration with applications, allowing organizations to configure social identity providers directly to facilitate seamless consumer access and apply conditional access policies.

Microsoft Entra ID Privileged Identity Management (PIM) is a core component of identity governance designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. PIM helps mitigate the risks associated with excessive, unnecessary, or misused access permissions by providing just-in-time (JIT) access, time-bound access, and requiring approval or multi-factor authentication for role activation. It specifically governs privileged roles by enforcing principles like least privilege and zero trust, ensuring that elevated permissions are only granted when absolutely necessary and for a limited duration.

The `Search-UnifiedAuditLog` cmdlet, combined with the `-Operations FileAccessed, FileModified` parameters, precisely targets the auditing of these specific file activities. The `-SiteIds` parameter scopes the search to the designated HR SharePoint site, and the `-StartDate` and `-EndDate` parameters accurately define the 90-day look-back period. This command effectively retrieves a comprehensive list of audit records detailing when files were accessed or modified within that specific site and timeframe.

Device compliance policies in Microsoft Intune are specifically designed to define the security posture and configuration requirements that a device must meet to be considered "compliant." By specifying a minimum OS version, this policy directly establishes the foundational device-level standard required. This makes it the essential first step for enforcing operating system requirements before access to corporate resources can be granted.