The suggested safeguard ‘Leave broad antivirus exclusions active without tracking detections or reviewing their necessity’ would leave the demonstrated risk unresolved. Set alerts on disabled or unhealthy antivirus states.

The alternative ‘Validate onboarding package/platform compatibility and tenant service configuration’ is not the continuing control for this configuration. The relevant safeguard is ‘Set alerts on disabled or unhealthy antivirus states’.

The alternative ‘Audit exclusion scope and expire obsolete exceptions’ is not the continuing control for this configuration. The relevant safeguard is ‘Set alerts on disabled or unhealthy antivirus states’.

The proposed ‘Configure a BitLocker policy without confirming the correct device identity or whether its recovery protector is escrowed’ does not implement the required change. BitLocker encryption protects data at rest and recovery escrow enables authorized repair.

The alternative ‘Check per-setting disk encryption status, TPM readiness and device encryption prerequisites’ does not implement the required action ‘Deploy an Intune endpoint security disk encryption policy for BitLocker with appropriate recovery-key backup’. BitLocker encryption protects data at rest and recovery escrow enables authorized repair.

The alternative ‘Verify device identity, key ID, and authorized self-service retrieval before releasing any recovery secret’ does not implement the required action ‘Deploy an Intune endpoint security disk encryption policy for BitLocker with appropriate recovery-key backup’. BitLocker encryption protects data at rest and recovery escrow enables authorized repair.

BitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings. The controlling technical behavior here is bitLocker encryption protects data at rest and recovery escrow enables authorized repair.

BitLocker recovery records must be matched to the device protector rather than only the user's email. The controlling technical behavior here is bitLocker encryption protects data at rest and recovery escrow enables authorized repair.

The proposition ‘Disk encryption policy assignment alone proves both successful encryption and correct recovery key escrow’ is not the reason the selected control works. BitLocker encryption protects data at rest and recovery escrow enables authorized repair.

The proposed observation ‘A policy reports assignment success, but the device remains unencrypted or no matching recovery key ID is available’ does not establish the target state. An encrypted device reports compliant status and an authorized key exists for its correct identity.

The corrected device reaches protected status with recovery-key escrow confirmed. The required observation is an encrypted device reports compliant status and an authorized key exists for its correct identity.

The selected device's recovery key ID matches the approved recovery record. The required observation is an encrypted device reports compliant status and an authorized key exists for its correct identity.

The alternative ‘Require role-restricted recovery access and audit key views’ is not the continuing control for this configuration. The relevant safeguard is ‘Review key retrieval privileges and rotate keys after exposure’.

The suggested safeguard ‘Permit unrestricted recovery-key disclosure without recording key access or rotating exposed secrets’ would leave the demonstrated risk unresolved. Review key retrieval privileges and rotate keys after exposure.

The alternative ‘Track nonencrypted endpoints and encryption failure causes in compliance reporting’ is not the continuing control for this configuration. The relevant safeguard is ‘Review key retrieval privileges and rotate keys after exposure’.

The alternative ‘Check Defender sensor onboarding and service-health prerequisites rather than assuming policy assignment equals protection’ does not implement the required action ‘Verify device identity, key ID, and authorized self-service retrieval before releasing any recovery secret’. BitLocker recovery records must be matched to the device protector rather than only the user's email.

The proposed ‘Configure a BitLocker policy without confirming the correct device identity or whether its recovery protector is escrowed’ does not implement the required change. BitLocker recovery records must be matched to the device protector rather than only the user's email.

The alternative ‘Deploy an Intune endpoint security disk encryption policy for BitLocker with appropriate recovery-key backup’ does not implement the required action ‘Verify device identity, key ID, and authorized self-service retrieval before releasing any recovery secret’. BitLocker recovery records must be matched to the device protector rather than only the user's email.

ASR rules restrict risky child-process and script behaviors rather than merely blocking files by name. The controlling technical behavior here is bitLocker recovery records must be matched to the device protector rather than only the user's email.

The proposition ‘Disk encryption policy assignment alone proves both successful encryption and correct recovery key escrow’ is not the reason the selected control works. BitLocker recovery records must be matched to the device protector rather than only the user's email.

BitLocker encryption protects data at rest and recovery escrow enables authorized repair. The controlling technical behavior here is bitLocker recovery records must be matched to the device protector rather than only the user's email.

The proposed observation ‘A policy reports assignment success, but the device remains unencrypted or no matching recovery key ID is available’ does not establish the target state. The selected device's recovery key ID matches the approved recovery record.

A risky pilot device receives the intended risk-based compliance treatment. The required observation is the selected device's recovery key ID matches the approved recovery record.

An encrypted device reports compliant status and an authorized key exists for its correct identity. The required observation is the selected device's recovery key ID matches the approved recovery record.

The alternative ‘Deploy ASR changes in audit mode before blocking where compatibility risk exists’ is not the continuing control for this configuration. The relevant safeguard is ‘Require role-restricted recovery access and audit key views’.

The suggested safeguard ‘Permit unrestricted recovery-key disclosure without recording key access or rotating exposed secrets’ would leave the demonstrated risk unresolved. Require role-restricted recovery access and audit key views.

The alternative ‘Track nonencrypted endpoints and encryption failure causes in compliance reporting’ is not the continuing control for this configuration. The relevant safeguard is ‘Require role-restricted recovery access and audit key views’.

The alternative ‘Use Defender for Endpoint alert and incident investigation, correlating the enrolled device identity’ does not implement the required action ‘Check per-setting disk encryption status, TPM readiness and device encryption prerequisites’. BitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings.

The proposed ‘Configure a BitLocker policy without confirming the correct device identity or whether its recovery protector is escrowed’ does not implement the required change. BitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings.

The alternative ‘Verify device identity, key ID, and authorized self-service retrieval before releasing any recovery secret’ does not implement the required action ‘Check per-setting disk encryption status, TPM readiness and device encryption prerequisites’. BitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings.

The proposition ‘Disk encryption policy assignment alone proves both successful encryption and correct recovery key escrow’ is not the reason the selected control works. BitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings.

BitLocker encryption protects data at rest and recovery escrow enables authorized repair. The controlling technical behavior here is bitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings.

An assigned EDR policy is insufficient if sensor onboarding or connectivity is broken. The controlling technical behavior here is bitLocker policy can fail when the device cannot satisfy encryption prerequisites or has conflicting settings.