A transit authority leader wants a plain description of Microsoft Defender XDR without a full SOC playbook. Which statement is appropriate?

At fundamentals level, Microsoft Defender XDR correlates Microsoft 365 security signals across workloads to help detect and investigate threats. A transit authority leader needs that plain purpose statement: coordinated protection and investigation across email, endpoints, identities, and related signals—not a full SOC playbook. Defender XDR complements identity and collaboration services; it does not enforce Conditional Access policies or multifactor authentication controls for Microsoft 365 user sign-ins. Claiming Defender XDR applies sensitivity labels and data loss prevention policies across Microsoft 365 workloads to protect files fails because sensitivity labels and DLP policies are Microsoft Purview information protection controls, while XDR correlates signals to help detect and investigate threats. Claiming Defender XDR enforces Conditional Access policies and multifactor authentication controls for Microsoft 365 user sign-ins fails because XDR correlates security signals across workloads and does not handle identity operations such as Conditional Access enforcement or MFA controls. Limiting Defender XDR to managing device compliance policies and app deployment profiles through Microsoft Intune for enrolled devices fails because XDR correlates security signals across workloads and does not provide device compliance management or app deployment capabilities, which belong to Intune. Exam caveat: AB-900 wants accurate describe-level purpose without requiring deep incident-response procedures. Keep municipal leadership messaging on correlate-detect-investigate across workloads. Do not conflate XDR with applying sensitivity labels and data loss prevention policies across Microsoft 365 workloads to protect files, enforcing Conditional Access policies and multifactor authentication controls for Microsoft 365 user sign-ins, or with managing device compliance policies and app deployment profiles through Microsoft Intune for enrolled devices. Operational check: Brief transit leadership with a one-page purpose statement: Defender XDR correlates security signals across Microsoft 365 workloads to detect and investigate threats. Show a sanitized example tying an email alert to a related endpoint or identity signal. Confirm Entra ID remains the identity service and that Defender XDR does not manage device compliance policies or app deployment profiles through Microsoft Intune for enrolled devices.