You have 500 Windows 11 PCs that are Microsoft Entra joined and enrolled in Intune. You will manage Microsoft Defender for Endpoint on these devices and need to stop users from disabling Defender for Endpoint. Which action should you take?

Creating an antivirus policy in Intune allows you to configure Microsoft Defender Antivirus settings, including preventing users from disabling Defender for Endpoint. This policy directly manages the security features of the endpoint protection. Creating a security baseline applies a recommended set of security configurations but may not specifically address the user-disabling aspect of Defender for Endpoint with the granular control needed. A Conditional Access policy in Microsoft Entra ID controls access to resources based on conditions, not device security settings. A device compliance policy assesses device health and compliance with organizational standards but doesn't directly configure or prevent users from altering security features like disabling Defender for Endpoint.