You can manage many of the Microsoft 365 Business security features in the admin center, which gives you a simplified way to turn these features on or off. In the admin center, you can do the following:
Set application management settings for Android or iOS devices.
These settings include deleting files from an inactive device after a set period, encrypting work files, requiring that users set a PIN, and so on.
Set application protection settings for Windows 10 devices.
These settings can be applied to company data on both company-owned, or personally owned devices.
Set device protection settings for Windows 10 devices.
You can enable BitLocker encryption to help protect data in case a device is lost or stolen, and enable Windows Exploit Guard to provide advanced protection against ransomware.
Remove company data from devices.
You can remotely wipe company data if a device is lost, stolen, or an employee leaves your company.
Reset Windows 10 devices to their factory settings.
You can reset any Windows 10 devices that have device protection settings applied to them.
References:
https://docs.microsoft.com/en-us/microsoft-365/business/security-features

Reference:
https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-
365-plan-options
https://www.microsoft.com/en-us/microsoft-365/enterprise/f3?activetab=pivot%3aoverviewtab

References:
https://docs.microsoft.com/en-us/intune/app-protection-policy