Explanation:

Microsoft's Identity Protection provides risk-based detections and automated policies-not group management. Microsoft Learn explains that Identity Protection "uses detections to identify potential vulnerabilities affecting your organization's identities" and exposes user risk and sign-in risk for policy decisions. It does not support adding users to groups by "risk level"; group membership is handled by static or dynamic rules based on directory attributes, while risk is a transient signal surfaced to policies.
Identity Protection includes specific detections such as "Leaked credentials", where Microsoft's threat intelligence finds credentials "on the dark web or other dumps," and flags the affected account as risky. This directly confirms the ability to detect whether credentials have been exposed publicly.
For enforcement, Identity Protection policies and Conditional Access can require stronger authentication when risk is present. The documentation states that you can configure policies to "require multi-factor authentication for sign-ins assessed as risky" and use Conditional Access conditions like User risk or Sign-in risk with the grant control Require multi-factor authentication. Thus, Identity Protection signals can invoke MFA based on risk, but they do not place users into groups.

Microsoft 365 Endpoint Data Loss Prevention (Endpoint DLP) extends DLP controls directly to supported desktops. Microsoft states: "Endpoint DLP extends the activity monitoring and protection capabilities of DLP to Windows 10 (and later) devices." The platform coverage is explicitly broadened to Apple desktops:
"Endpoint DLP for macOS enables the same set of DLP capabilities on macOS devices (supported versions) so you can monitor and protect sensitive items across Windows and Mac endpoints." At the same time, Microsoft clarifies the mobile scope: "Endpoint DLP is supported on Windows and macOS devices." This means Android is not a supported operating system for Endpoint DLP (mobile data protection on Android uses different controls such as app protection policies via Microsoft Intune and conditional access). Therefore, the correct pairing of operating systems for Endpoint DLP support is Windows 10 and newer, and macOS- not Android. This aligns with Microsoft's Endpoint DLP platform support guidance and the intended desktop- focused endpoint protections for activities such as file copy, print, upload, and removable media interactions.

Explanation:

Microsoft's SCI guidance defines the supported passwordless methods in Entra ID (Azure AD). The documentation states: "Microsoft recommends three passwordless authentication options: Windows Hello for Business, FIDO2 security keys, and the Microsoft Authenticator app (phone sign-in)." Windows Hello for Business "replaces passwords with strong two-factor authentication on Windows devices," allowing users to sign in with a gesture (biometric or PIN) that does not require a password during interactive sign-in. Likewise,
"FIDO2 security keys enable users to sign in using an external security key," providing a standards-based passwordless credential that can work across supported browsers and devices.
By contrast, OATH software tokens (for example, time-based one-time passcodes in an authenticator app) are documented as multifactor verification methods: "OATH software tokens generate time-based codes used for MFA." These OTP codes serve as a second factor and are not a passwordless primary sign-in method; users typically still enter a password and then the OTP. Therefore: software tokens # No (not passwordless), Windows Hello # Yes, FIDO2 security keys # Yes. This mapping aligns directly with Microsoft's Entra ID passwordless authentication guidance and the delineation between passwordless sign-in and MFA second- factor methods.

Explanation:

In Microsoft's Security, Compliance, and Identity portfolio, Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) integrates directly with Microsoft Entra Conditional Access to provide Conditional Access App Control-Microsoft's real-time session control. Microsoft's documentation describes this capability as enabling organizations to "monitor and control user sessions in real time" and to "protect downloads, restrict uploads, block copy/paste and print, and apply access or session policies" for sanctioned and unsanctioned applications. The enforcement is achieved through a reverse-proxy session that is invoked by Conditional Access policy decisions, allowing continuous inspection and dynamic controls after authentication.
By contrast, other options in the list do not offer real-time session enforcement via Conditional Access. Azure AD Privileged Identity Management (PIM) focuses on just-in-time role activation, approval workflows, and access reviews for privileged accounts-not session control of app usage. Microsoft Defender for Cloud provides cloud security posture management and workload protection across Azure, multicloud, and hybrid resources-again, not Conditional Access-based user session governance. Microsoft Sentinel is a SIEM
/SOAR solution used for ingestion, detection, investigation, and response; it does not apply Conditional Access policies to control user sessions. Therefore, the service that can use Conditional Access policies to control sessions in real time is Microsoft Defender for Cloud Apps through Conditional Access App Control.

Explanation:

Microsoft documents for Defender for Endpoint (MDE) describe it as an enterprise endpoint security platform that supports Windows 10/11, Windows Server, Linux, macOS, and mobile platforms (Android and iOS
/iPadOS). The platform provides threat and vulnerability management, attack surface reduction, next- generation protection, endpoint detection and response, and automated investigation and remediation across those supported operating systems. Because MDE supports Windows client operating systems and servers, it can also be used on Azure virtual machines that run supported Windows versions; onboarding methods include local scripts, Microsoft Endpoint Manager, or cloud integrations, allowing VM endpoints to receive the same protection and EDR capabilities as physical devices.
By contrast, malware scanning in SharePoint Online, OneDrive, and Microsoft Teams is provided by Microsoft Defender for Office 365 (Safe Attachments for SharePoint, OneDrive, and Teams)-a different service within the Microsoft 365 Defender family. This service analyzes files as they are uploaded or shared to detect and block malicious content in collaboration workloads, which is outside the scope of MDE's endpoint-focused protections. Therefore: Android protection (Yes), Azure VMs running Windows 10 (Yes), and SharePoint Online anti-virus protection by MDE (No, handled by Defender for Office 365).