Microsoft places Attack simulation training under the email and collaboration protection workloads of Microsoft Defender for Office 365 (MDO). The official product guidance describes it as a built-in capability that "lets you run realistic attack scenarios in your organization to identify vulnerable users and train users to recognize and report phishing and other social-engineering techniques." Microsoft further notes that Attack simulation training "provides editable phishing payloads, credential-harvesting and attachment scenarios, landing pages, user training, and detailed reporting," enabling security teams to measure compromise rates and improve user resilience over time. The service scope is explicit: "Attack simulation training is a feature of Microsoft Defender for Office 365 Plan 2," and it is included in suites that contain MDO P2 such as Microsoft
365 E5 and Office 365 E5. In the Microsoft 365 Defender portal, you access it under Email & collaboration # Attack simulation training, where admins can create simulations, target groups, assign training, and review metrics like repeat offenders, resilience score, and simulation results. By design, this feature is not part of Microsoft Defender for Cloud Apps (cloud app security and CASB functions), not part of Microsoft Defender for Identity (on-prem AD identity threat detection), and not part of Defender for SQL. Therefore, the Microsoft SCI documentation aligns that the correct service hosting Attack simulation training is Microsoft Defender for Office 365 (Plan 2).

Microsoft Defender for Office 365 includes Safe Attachments, a protection that "checks attachments in a secure, virtual environment to detect malicious behavior." In Microsoft's guidance, Safe Attachments is described as part of the anti-malware pipeline that "routes messages with attachments to a detonation chamber; if no suspicious activity is detected, the message is released to the recipient, and if malicious behavior is found, the attachment is blocked or removed." Administrators can choose Block, Replace, Dynamic Delivery, or Monitor actions. The Dynamic Delivery option specifically supports the use case in the question: the email body is delivered while the attachment is scanned, and "the attachment is automatically reattached and forwarded to the recipient only when it is determined to be safe." This capability is unique to Defender for Office 365's Safe Attachments, not to be confused with endpoint antivirus or identity tools.
Defender Antivirus protects Windows devices, Defender for Identity secures on-premises identities, and Defender for Endpoint focuses on endpoint detection and response. Therefore, the Microsoft service you use to scan email attachments and forward them only when clean is Microsoft Defender for Office 365 (Safe Attachments).

You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

Explanation:

Microsoft defines hybrid identity as enabling a common identity across on-premises and cloud by integrating your directory services. Microsoft Learn states: "Hybrid identity is achieved by integrating your on-premises Active Directory with Azure Active Directory." This integration is delivered through the synchronization and optional federation capabilities that connect AD DS to Azure AD so users can access both on-premises and cloud resources with one identity.
To implement this integration, Microsoft's tooling is explicit: "Azure AD Connect is the Microsoft tool designed to meet and accomplish your hybrid identity goals." Azure AD Connect (now Microsoft Entra Connect) synchronizes users, groups, and optionally passwords or hashes to Azure AD, providing the foundation for hybrid scenarios such as single sign-on and seamless sign-in.
Regarding tenants, Microsoft's identity platform clarifies that "A Microsoft 365 organization is associated with a single Azure AD tenant." Therefore, a hybrid identity deployment does not require two Microsoft 365 tenants; it typically links a single Azure AD (Microsoft Entra ID) tenant with one or more on-premises AD DS forests. In summary, Azure AD Connect enables hybrid identity, hybrid identity is the synchronization
/integration of AD DS with Azure AD, and it does not necessitate multiple Microsoft 365 tenants.

Explanation:

Microsoft states that Security defaults are baseline protections in Azure Active Directory (now Microsoft Entra ID) that "make it easier to help protect your organization from identity-related attacks." One of the core behaviors is that security defaults "require all users to register for Azure AD Multi-Factor Authentication," and enforce "multi-factor authentication for all users," with special emphasis that "administrators are required to do multi-factor authentication." Security defaults also "block legacy authentication" and add protections for privileged operations, but the universal control that applies to every user is MFA. Importantly, enabling security defaults does not turn on paid capabilities such as Azure AD Identity Protection or Privileged Identity Management (PIM); those are separate, premium features. The baseline is intentionally simple and tenant- wide: require MFA registration, challenge with MFA when risk or sensitive operations are detected, and reduce exposure by disabling legacy protocols. Therefore, when you enable security defaults, multi-factor authentication (MFA) will be enabled for all Azure AD users, aligning with Microsoft's guidance that security defaults "help protect all organizations by requiring MFA and disabling legacy authentication."