A municipal permitting office wants a protection family that correlates signals across endpoints and email rather than treating each alert in isolation. Which choice fits at describe depth?

Microsoft Defender XDR is the protection family positioned to correlate signals across endpoints and email rather than forcing municipal IT to treat each alert in isolation. For a permitting office facing threats that start in email and continue on devices, that cross-signal approach is the describe-depth answer: one investigation narrative spanning workloads instead of disconnected mailbox rules and endpoint tickets. AB-900 expects recognition of that correlated protection concept.

Microsoft Defender for Endpoint as the cross-signal protection approach spanning email and endpoints fails because that description overstates its scope—it is scoped to endpoint telemetry alone—it does not correlate those signals with what is happening in email the way Defender XDR does. Microsoft Defender for Office 365 as the cross-signal protection approach for email and endpoints fails the same requirement in the other direction—it is scoped to email and collaboration signals alone and does not correlate what happens afterward on an endpoint, so alerts stay siloed rather than tied into one cross-channel investigation. Microsoft Defender for Identity as the cross-signal protection approach spanning email and endpoints fails because that description misstates its scope—it is scoped to identity signals from on-premises Active Directory and Microsoft Entra ID, not email-and-endpoint correlation, so it does not provide the cross-signal investigation across those workloads the way Defender XDR does.

Exam caveat: Fundamentals depth is naming Defender XDR's cross-signal purpose, not running a full SOC incident from scratch. Defender for Endpoint, Defender for Office 365, and Defender for Identity are real, valuable individual Defender products, but each is single-workload—don't substitute any one of them for the cross-signal correlation that XDR specifically provides.

Operational check: In a tabletop or portal walkthrough, map a sample permitting phishing alert to related endpoint signals under Defender XDR concepts, confirm audit logging remains on across both email and endpoint products, and document that XDR's cross-signal correlation—not Defender for Endpoint, Defender for Office 365, or Defender for Identity in isolation—is the protection approach for cross-channel incidents.