Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 376–450

Microsoft Entra Identity Protection is a core security capability of Microsoft Entra ID P2, designed to detect, investigate, and remediate identity-based risks. It leverages machine learning and heuristics to identify suspicious activities, such as leaked credentials, impossible travel, and anomalous sign-in patterns, across an organization's identities. This feature provides automated responses like requiring multi-factor authentication or blocking access, significantly enhancing an organization's security posture against identity compromise.

Microsoft Purview Audit (Premium) is the correct choice because it provides the advanced auditing capabilities essential for a comprehensive legal investigation. It offers extended retention of audit logs, high-volume export functionality, and crucially, detailed logging of 'before' and 'after' values for specific activities. This granular detail allows legal teams to perform deep forensic analysis of user actions and content changes, providing irrefutable evidence for a lawsuit.

Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against a wide array of international, national, and industry-specific regulations, such as GDPR and CCPA. It provides a comprehensive solution for assessing, monitoring, and improving compliance by offering a compliance score, actionable improvement recommendations, and the ability to assign tasks to meet specific control requirements. This tool is essential for companies operating globally, needing to track their adherence to multiple, evolving regulatory frameworks.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations within the Microsoft 365 environment and beyond. DLP policies can be configured with rules that detect specific types of sensitive information, such as financial data or personally identifiable information (PII), within content. Upon detection, these policies can be set to automatically apply a designated Microsoft Purview sensitivity label to the content, thereby enforcing predefined protection actions like encryption, access restrictions, or visual markings.

Creating and publishing sensitivity labels is a foundational capability of Microsoft Purview Information Protection. These labels allow organizations to classify data based on its sensitivity level, applying visual markings (like headers or watermarks) and persistent protection actions such as encryption and access restrictions. This ensures that sensitive documents and emails remain protected, even when shared outside the organization, as the protection travels with the data.

Conditional Access App Control integrates directly with Azure AD Conditional Access policies to route user sessions through Defender for Cloud Apps. This enables real-time monitoring and control over user activities within cloud applications, such as preventing data downloads, uploads, or copy-pasting based on policy conditions. This granular, session-level enforcement is crucial for securing data in real-time during active user sessions, making it the correct solution for immediate data access restrictions.

This policy is configured with a "delete" action after 365 days, meaning it will permanently remove content that matches its criteria once the retention period expires. It does not include a "retain" action to preserve content for a specified duration, only to dispose of it. If the intent was to ensure content availability or prevent early deletion, this configuration is counterproductive, as it solely focuses on content disposition.

Microsoft Entra ID P2 includes Access reviews, a critical governance feature enabling organizations to efficiently manage group memberships, application assignments, and privileged role assignments. This feature allows administrators to regularly review who has access to what resources, ensuring that only necessary permissions are maintained and reducing the risk of stale or excessive access. Without P2, these automated and recurring reviews are not available, making manual auditing cumbersome and prone to oversight.

Single sign-on (SSO) is a fundamental capability of Microsoft Entra ID, enabling users to access multiple applications and services with a single set of credentials. By acting as a centralized identity provider, Entra ID streamlines the authentication process, significantly enhancing user productivity and reducing password fatigue. This core feature simplifies access management across cloud and on-premises resources, ensuring a consistent and secure user experience.

Microsoft Purview Data Map scanning is the foundational capability responsible for automatically discovering, cataloging, and classifying data across an organization's entire data estate, including on-premises, multi-cloud, and SaaS sources. It uses built-in and custom classification rules, sensitive information types, and machine learning to identify sensitive data patterns and apply appropriate labels or classifications, populating the Data Map with metadata for governance. This process is central to understanding and managing data risk.

Defender for Cloud includes vulnerability assessment capabilities that cover VMs in Azure and on-premises (via Azure Arc). It provides a single dashboard showing missing patches and CVEs with actionable recommendations, and supports both agentless and agent-based scanning.

The conditions only include userRiskLevels, not signInRiskLevels.

This option correctly identifies the appropriate Microsoft security and compliance services for each requirement. Conditional Access policies effectively enforce multi-factor authentication based on various conditions, enhancing sign-in security. Microsoft Defender for Cloud Apps provides the necessary Cloud Access Security Broker (CASB) capabilities to discover, assess, and block unapproved or risky OAuth applications. Microsoft Defender for Identity accurately detects advanced identity-based threats by monitoring on-premises Active Directory signals. Lastly, Microsoft Purview Information Protection is specifically designed to classify, label, and protect sensitive data across its lifecycle.

Microsoft Defender for Endpoint is a foundational component of Microsoft 365 Defender, providing robust endpoint detection and response (EDR) capabilities across various operating systems. It offers next-generation protection, automated investigation and remediation, and vulnerability management, integrating its rich telemetry directly into the unified M365 Defender portal. This integration enables comprehensive visibility and coordinated threat response across devices, ensuring endpoints are protected from sophisticated attacks.

Confidentiality is the principle that sensitive information is protected from unauthorized disclosure or access, ensuring that only authorized individuals or systems can read or interpret it. When a company encrypts sensitive customer data in Azure SQL, both at rest (e.g., using Transparent Data Encryption) and in transit (e.g., using TLS/SSL connections), it directly prevents unauthorized parties from understanding the data's content, even if they gain access to the raw data files or network traffic. This makes encryption a fundamental control for upholding data confidentiality.

eDiscovery (Premium) is the correct service for placing content on legal hold. It enables organizations to identify, preserve, collect, process, and review electronically stored information (ESI) for legal or investigative purposes. A key feature is the ability to apply eDiscovery holds to specific content locations, such as mailboxes and SharePoint sites, which prevents the permanent deletion of data, even if existing retention policies would otherwise dictate its removal. This ensures data integrity for ongoing investigations.

A Device compliance policy is the correct choice because it specifically defines the security posture and configuration requirements that a mobile device must meet to be considered compliant. This includes setting rules for device-wide security features such as requiring a PIN, specifying its minimum length, or enforcing encryption. Intune evaluates devices against these defined rules and reports their compliance status, which is then used by other policies for access enforcement.

Microsoft Purview eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to identify, preserve, collect, and produce electronically stored information (ESI) for legal and investigative purposes. It enables organizations to place immutable legal holds on content across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, ensuring data integrity. Furthermore, it provides robust search capabilities to pinpoint relevant information and allows for secure export of collected content in a defensible format for legal review.

For Search-UnifiedAuditLog to return any audit records, unified audit logging must first be explicitly enabled for the entire Microsoft 365 tenant. If this foundational setting is disabled, no user or administrator activities, including file downloads or access, are recorded in the audit log, regardless of user actions or command syntax. Consequently, any attempt to search the audit log will yield no results, indicating a lack of recorded data rather than a lack of activity or a syntax error.

This is the correct DLP configuration to block emails with credit card numbers.

This is a core principle of Zero Trust, mandating that no access is granted based on implicit trust derived from network location or previous authentication. Every single request for a resource must be rigorously authenticated and authorized. This process involves evaluating multiple data points, including user identity, device health, location, and the sensitivity of the resource being accessed, to ensure least privilege access is consistently applied.

A Safe Links policy is designed to protect users from malicious URLs by providing time-of-click verification of web addresses in email and other Microsoft 365 apps. When a user clicks a link, Safe Links rewrites the URL and checks it against a list of known malicious sites, blocking access or warning the user if the destination is deemed unsafe. This proactive defense is specifically engineered to counter threats delivered via embedded links, making it the appropriate solution for protecting against malicious URLs.

The creation of a sensitivity label, such as 'Highly Confidential - PHI' with specific protection settings like encryption and header, is the fundamental first step. This label defines the classification and the associated protective actions for the data. Subsequently, publishing the label makes it available for users to apply manually and for auto-labeling policies to utilize, establishing the core data protection framework.

Configuring a DLP policy with an override option that allows users to justify sharing is the most appropriate solution for balancing security with legitimate business needs. This feature enables organizations to enforce strong data protection while providing a controlled mechanism for users to temporarily bypass a policy when a valid business reason exists, such as sharing specific audit-related documents externally. The justification provided by the user is logged, creating an essential audit trail for compliance and review, ensuring accountability without completely blocking necessary collaboration.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security logs from various sources, including Microsoft Entra ID audit logs, to detect threats using analytics rules defined with Kusto Query Language (KQL). An analytics rule can identify specific events, such as unauthorized role assignments, and then trigger an automated playbook (built with Azure Logic Apps) to perform immediate response actions like revoking a role, isolating a user, or sending notifications, directly addressing the need for detection and automated response to identity-related security incidents.

A retention policy in Microsoft Purview is the correct mechanism for enforcing a consistent retention schedule across an entire location, such as a SharePoint site. By applying a retention policy to a SharePoint site, all content within that site will automatically inherit the specified retention period (e.g., retain for 5 years) and subsequent disposition action (e.g., then delete). This ensures comprehensive, site-wide compliance with data retention requirements without requiring individual item-level application.

This option accurately describes the KQL query's purpose. The query filters events for a *specific user* within the *last 30 days*, focusing exclusively on *file upload* activities. It then *groups these uploads by file type* and subsequently filters the results to display only those *file types that the user uploaded more than 10 times*, effectively identifying frequently uploaded file types by that individual.

Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides comprehensive visibility, control, and protection for cloud applications. It integrates with Microsoft Entra Conditional Access to enforce session policies by acting as a reverse proxy, allowing real-time monitoring and control over user activities within cloud apps. This capability enables organizations to block downloads, restrict copy-paste, or enforce other granular controls during a user's session, directly addressing the need for session policies.

Anomaly detection policies identify unusual user behavior, such as mass downloads, based on learned baselines.

Scheduled query analytics rules are the most versatile and powerful type for implementing custom threat detection logic within Microsoft Sentinel. They enable security analysts to write complex KQL (Kusto Query Language) queries that run at defined intervals against various log tables, allowing for sophisticated correlation, aggregation, and pattern matching to identify specific security events, conditions, or indicators of compromise.

The 'Sign-in risk' condition, powered by Microsoft Entra ID Protection, specifically evaluates the real-time risk associated with an individual sign-in attempt. It utilizes machine learning to detect anomalies such as impossible travel, sign-ins from unfamiliar locations or devices, or atypical sign-in properties. Setting this condition to 'Medium and above' and granting 'Require MFA' directly addresses suspicious sign-in patterns by challenging potentially compromised sessions with an additional verification factor, thereby preventing unauthorized access.

A Sensitive Information Type (SIT) for passport numbers is crucial because it defines the specific pattern, keywords, and proximity rules required to accurately identify passport numbers within content. This detection mechanism is a fundamental prerequisite for any automated process that aims to classify and protect documents containing such sensitive personal data. Without a defined SIT, Microsoft Purview would be unable to reliably locate and flag passport numbers for subsequent labeling actions.

Identity Protection is a crucial Microsoft Entra ID feature that automatically detects, remediates, and reports identity-based risks. It analyzes sign-in and user behavior for anomalies, such as impossible travel, leaked credentials, or unfamiliar sign-in properties. By identifying these risks, it can trigger automated responses like blocking access, enforcing multi-factor authentication, or requiring password resets, significantly reducing the potential for compromised identities to facilitate lateral movement or data breaches.

Meets all requirements.

Microsoft Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP) across hybrid and multi-cloud environments. It delivers a secure score, actionable recommendations, and advanced threat detection for servers, containers, databases, and more.

This foundational Zero Trust principle mandates that all access requests, regardless of their origin or the resource being accessed, must be authenticated and authorized continuously. It requires leveraging all available data points, such as user identity, device health, location, service, and data classification, to make dynamic access decisions. This 'never trust, always verify' approach ensures that trust is never implicit and is re-evaluated with every interaction, moving beyond traditional perimeter-based security.

Information Barriers are essential for preventing unauthorized communication and collaboration between specific user groups, fulfilling the "Chinese Wall" requirement in financial services. Complementing this, Data Loss Prevention (DLP) policies actively detect and prevent the sharing of sensitive information, such as credit card numbers, both internally and externally. Together, these solutions provide robust controls for communication segmentation and sensitive data protection, directly addressing both critical organizational needs.

Zero Trust explicitly verifies every access, enforces least privilege, and assumes breach, matching the description.

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection for data and user activities across sanctioned and unsanctioned cloud applications. It enables organizations to discover shadow IT, monitor user sessions in real-time, enforce data loss prevention policies, and detect anomalous behavior in third-party cloud services like Box, Dropbox, or Salesforce. This capability directly addresses the need to monitor user activities within external cloud applications.

Azure Active Directory (Azure AD) sign-in logs use specific error codes to indicate the reason for a failed authentication attempt. Error code 50076 specifically signifies that the user failed to complete the multi-factor authentication (MFA) challenge required for access. This could be due to the user not responding to the MFA prompt, entering an incorrect verification code, or declining the authentication request. Consequently, the sign-in attempt was unsuccessful because the mandatory second factor was not satisfied.

Microsoft 365 Defender is the unified XDR (eXtended Detection and Response) solution that integrates signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This platform provides a holistic view, correlating alerts and incidents across email, endpoints, identities, and cloud applications. For a phishing campaign, it enables security analysts to trace the entire attack chain, from the initial email delivery and user interaction to potential endpoint compromise or identity theft, offering comprehensive investigation and response capabilities.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations within an organization. A compliance officer can configure DLP policies to detect specific sensitive information types, such as Medical Record Numbers (MRNs), and then enforce actions like blocking emails or other sharing attempts containing that data, thereby directly preventing unauthorized disclosure.

The Microsoft Authenticator app facilitates passwordless authentication by transforming a user's mobile device into a strong credential. Users can approve sign-in requests via push notifications, verifying their identity with a biometric gesture like a fingerprint or face scan, or a PIN. This method eliminates the need for traditional passwords, significantly enhancing security by making authentication phishing-resistant and improving user experience.

This option accurately describes the primary actions configured within a Communication Compliance policy when a violation is detected. The system is engineered to notify designated policy owners or reviewers and automatically generate a case within the Microsoft Purview compliance portal. This workflow facilitates a structured investigation and remediation process for identified policy breaches.

Sensitivity labels are the correct and most comprehensive mechanism within Microsoft Purview for classifying data and applying a range of protective actions, including encryption, access restrictions, and visual markings. When configured with auto-labeling policies, these labels can automatically detect specific sensitive information types, such as credit card numbers, within content. Upon detection, the associated sensitivity label, along with its defined encryption and other protections, is automatically applied to the content, ensuring both classification and robust security.

Microsoft Entra ID Protection is specifically designed to detect, investigate, and remediate identity-based risks by leveraging machine learning and heuristics. It identifies suspicious activities like impossible travel, sign-ins from infected devices, anonymous IP addresses, or password spray attacks. This service automatically applies conditional access policies to block or challenge risky sign-ins, thereby protecting user accounts from compromise.

The Exchange admin center (EAC) is the dedicated web-based management console for Exchange Online, providing comprehensive control over mailboxes, recipients, permissions, and mail flow. Within the EAC, administrators can create and manage mail flow rules, also known as transport rules, which are powerful tools for inspecting and acting on messages based on various conditions, including subject keywords. These rules are essential for implementing specific organizational policies for email processing before or after Defender for Office 365's advanced protections.

The "Use least privilege access" principle dictates that users and devices should only be granted the minimum necessary permissions to perform their specific tasks, for the shortest possible duration. This is often implemented through Just-In-Time (JIT) and Just-Enough-Access (JEA) mechanisms, significantly reducing the potential blast radius and impact should an account or system become compromised. It ensures that even if an attacker gains access, their lateral movement and damage are severely limited.

The policy definition ID referenced in the assignment corresponds to a built-in Azure Policy that specifically checks for Transparent Data Encryption (TDE) on SQL databases. Combined with the 'AuditIfNotExists' effect, this policy assignment will scan existing SQL databases within its scope and report any instances where TDE is not enabled, making them visible in the Azure Policy compliance dashboard.

Retention labels published automatically can apply retention and deletion actions based on conditions, making them the correct choice.

eDiscovery (Premium) is the correct solution as it provides comprehensive capabilities specifically designed for legal investigations. This service allows organizations to identify and preserve relevant custodians, place immutable legal holds on data across various Microsoft 365 services, collect data from diverse sources, and process it into a secure review set for legal analysis without altering the original content, ensuring defensibility in litigation.

B2B collaboration allows you to invite external users to your tenant using their own identities (e.g., Google, Facebook, or any Microsoft Entra ID tenant). Combined with Conditional Access, you can enforce MFA for those guest users.

Microsoft retains responsibility for the physical security of datacenters, servers, storage, and networking hardware in all cloud models, including IaaS.

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) for hybrid environments. It offers integrated vulnerability assessment for Azure VMs and on-premises Windows servers, leveraging Azure Arc for the latter. Furthermore, it includes regulatory compliance dashboards to continuously monitor adherence to industry standards and provides threat detection capabilities across these diverse workloads.

Searching the unified audit log in Microsoft Purview is the correct approach because it provides a comprehensive record of user and administrator activities across a wide range of Microsoft 365 services, including Exchange Online, SharePoint Online, Teams, and Azure Active Directory. This log captures detailed information about specific actions performed, such as file access, permission changes, mailbox operations, and administrative configurations, along with timestamps, user identities, and IP addresses. It is the definitive source for investigating 'who did what, when, and where' within the organization's Microsoft 365 environment.

Microsoft Entra ID Governance offers automated access reviews, enabling organizations to periodically review and certify user access to groups, applications, and roles. These reviews ensure that users maintain only the necessary permissions, helping to enforce the principle of least privilege and reduce the risk of stale or excessive access. This feature streamlines compliance efforts by automating the process of obtaining attestations from resource owners and managers.

This option is correct because the query groups logon events by 'UserPrincipalName' and 'IPAddress', then counts the occurrences. By filtering for a high count (e.g., `count_ > 10`), it effectively identifies accounts or source IP addresses exhibiting an unusually large number of interactive sign-ins within the queried timeframe. This pattern is a strong indicator of potential brute-force attacks or credential stuffing attempts, where an attacker repeatedly tries to gain access to an account.

Microsoft Defender XDR (formerly Microsoft 365 Defender) is the correct choice because it provides extended detection and response capabilities across multiple security domains. It unifies signals from endpoints (Defender for Endpoint), email and collaboration (Defender for Office 365), identities (Defender for Identity), and cloud apps (Defender for Cloud Apps). This comprehensive correlation is crucial for investigating multi-stage attacks like ransomware, allowing analysts to trace the attack chain from initial compromise to impact across the entire Microsoft 365 ecosystem, offering a unified incident view.

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and threat protection for sanctioned and unsanctioned cloud applications. It directly monitors user activities within SaaS applications like Salesforce or Dropbox, detecting anomalous behavior, preventing data exfiltration, and enforcing compliance policies. This solution is purpose-built to address the unique security challenges posed by cloud application usage, offering real-time controls and deep insights into data movement and user interactions.

An auto-labeling policy is specifically designed to automatically apply sensitivity labels to content across Microsoft 365 services, including SharePoint, based on predefined conditions. These policies leverage sensitive information types, trainable classifiers, or keywords to identify sensitive data and then automatically assign the appropriate sensitivity label, directly fulfilling the requirement to classify and label documents without manual intervention.

The principle of least privilege dictates that every user, process, and program should be granted only the minimum necessary permissions to perform its legitimate function. In a document management system, this means a security policy would restrict access to documents strictly based on a user's role and specific job requirements, preventing unauthorized viewing or modification. This directly aligns with a policy requiring restricted access to documents to minimize potential misuse or data breaches.

Endpoint Data Loss Prevention (Endpoint DLP) extends DLP capabilities directly to Windows and macOS devices, enabling organizations to monitor and control sensitive information as it is used, shared, and transferred. It can detect when users attempt to copy sensitive data to removable media (like USB drives), network shares, cloud services, or print it, and then enforce policies to block, audit, or warn the user. This direct control over endpoint actions makes it the ideal solution for preventing data exfiltration via USB drives.

Sensitivity labels with auto-classification are the correct solution because they leverage content inspection rules, regular expressions, or trainable classifiers to automatically identify sensitive information within documents. Once identified, these labels can apply persistent protective actions such as encryption, visual markings (headers/footers/watermarks), and access restrictions, ensuring data is classified and secured at rest and in transit. This directly fulfills the requirement to automatically classify and protect documents containing sensitive data.

The KQL query is designed to identify specific security events by combining multiple filters. It targets events where files are shared externally (implied by the alert name or event type) and explicitly includes a condition to match `SensitivityLabel == 'Highly Confidential'`. This precise combination ensures that the query effectively detects and flags only those instances where highly confidential data is exposed outside the organization.

The exhibit implies the device is Azure AD joined, which is distinct from a Hybrid Azure AD joined device. A Hybrid Azure AD joined device is registered with both on-premises Active Directory and Azure Active Directory. If the Conditional Access policy is specifically configured to grant access only to Hybrid Azure AD joined devices, an Azure AD joined-only device would fail this requirement, leading to access being blocked. This mismatch in device join type is a common reason for Conditional Access policy enforcement.

Microsoft Entra Privileged Identity Management (PIM) is the correct solution for managing, controlling, and monitoring access to important resources within Microsoft Entra ID and other Microsoft online services. PIM specifically enables just-in-time (JIT) access to roles, time-bound assignments, and approval workflows for role activation. It allows organizations to delegate the management of role assignments, including the ability for designated users to assign eligible roles to others, thereby significantly reducing the standing access of highly privileged accounts.

Organizations frequently have unique internal policies or industry-specific regulations not covered by the extensive library of built-in templates. Microsoft Purview Compliance Manager provides the capability to create entirely new custom assessments from scratch. This allows administrators to define specific controls, assign implementation actions, track progress, and manage risks tailored precisely to their unique organizational compliance requirements, ensuring comprehensive coverage.

Microsoft Entra ID Password Protection directly addresses the challenge of weak and commonly used passwords by integrating a global banned password list and enabling administrators to create custom banned lists specific to their organization. This service actively checks passwords during creation, reset, or change operations against these lists, preventing users from setting easily guessable or compromised credentials. It ensures stronger password hygiene by proactively blocking known weak patterns, directly fulfilling the requirement to prevent common passwords.

Data Loss Prevention (DLP) is a core component of Microsoft Purview compliance solutions, designed to identify, monitor, and automatically protect sensitive information. DLP policies are applied across Microsoft 365 services, endpoints, and on-premises repositories to prevent the unauthorized sharing, transfer, or use of sensitive data. This capability is crucial for maintaining regulatory compliance and safeguarding organizational data.

This option is correct because a sensitivity label configured with 'UserDefined' protection empowers the user applying the label to specify who can access the document and precisely what permissions they possess. Instead of a fixed set of rights, the user can dynamically assign granular access controls, such as view-only, edit, or co-author, to specific individuals or groups at the point of content creation or modification. This provides flexible and context-aware data protection.

This combination provides a robust solution for automatic license assignment based on user attributes. Dynamic groups in Microsoft Entra ID automatically update their membership based on predefined rules that query user attributes (e.g., department, job title, location). When group-based licensing is then applied to such a dynamic group, all current and future members automatically receive the assigned licenses, and licenses are automatically revoked if a user's attributes change, causing them to no longer meet the group's membership criteria.

Conditional Access policies can require MFA based on conditions.

Microsoft Entra Access Reviews provide a systematic way for organizations to manage access lifecycle by regularly reviewing who has access to various resources. This feature allows administrators to create recurring reviews for group memberships, application assignments, and Microsoft Entra role assignments. Reviewers, such as group owners or managers, can then approve or deny access, with the system automatically removing unresponsive or denied users based on configured settings, ensuring least privilege.

Microsoft Defender for Endpoint is a comprehensive endpoint detection and response (EDR) solution that provides advanced threat protection, post-breach detection, automated investigation, and response capabilities for devices. It continuously monitors endpoint behavior, identifies malicious activities, and offers powerful remediation actions such as isolating compromised devices from the network and rolling back malicious file changes. These features are essential for containing and recovering from sophisticated endpoint attacks like ransomware.

Microsoft Entra B2B collaboration is the correct solution for enabling external partners to access resources within a company's Microsoft Entra ID tenant using their existing corporate identities. This feature allows inviting guest users from other Microsoft Entra organizations, social identity providers, or email-verified accounts, integrating them into the tenant for seamless access to applications and resources. It provides robust lifecycle management, allowing administrators to manage guest user access and permissions effectively.