SC-100: Microsoft Cybersecurity ArchitectDemo

Tenant restrictions v2 provides authentication-plane protection for every application that authenticates with Microsoft Entra ID, including all Microsoft and third-party (partner) apps that use Entra ID for sign-in, so the first blank is the Entra ID integrated apps option. For the data plane the documented Microsoft 365 coverage is SharePoint Online and Exchange Online (enforced via the tenant restrictions v2 data-plane path), which is far narrower than "all Microsoft 365 apps"; the all-M365-apps option overstates coverage (for example anonymous access and many services are not blocked). Note that Global Secure Access signaling by itself covers Microsoft Graph at the data plane, but among the offered choices the SharePoint Online/Exchange Online option is the intended data-plane answer and the only-M365-apps option is an overreach distractor.