Reference:
https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

Storage locations
Understand where Defender for Cloud stores data and how you can work with your data:
* Machine information
- Stored in a Log Analytics workspace.
- You can use either the default Defender for Cloud workspace or a custom workspace. Data is stored in accordance with the workspace location.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-data-workspace

Explanation:
The cloud-only users must be able to use SSPR.
Microsoft 365 Business Standard
The hybrid users must be able to use SSPR with password writeback to the domain.
Microsoft Entra ID P1
For cloud-only users, the lowest suitable option in the list is Microsoft 365 Business Standard. Microsoft states that basic SSPR capabilities are available in Microsoft 365 Business Standard or higher, and the licensing comparison shows cloud-only user password reset is supported by Microsoft 365 Business Standard, Business Premium, and Microsoft Entra ID P1 or P2. Since the requirement is only for cloud-only SSPR, assigning a higher Entra ID P1 or P2 license would increase cost unnecessarily.
For hybrid users who must reset passwords with password writeback to the on-premises AD DS domain, the correct minimum license is Microsoft Entra ID P1. Microsoft's licensing table identifies hybrid user password change or reset with on-premises writeback as supported by Microsoft 365 Business Premium and Microsoft Entra ID P1 or P2, and Microsoft explicitly warns that standalone Microsoft 365 Basic and Standard plans do not support SSPR with on-premises writeback.
Therefore, Business Standard is enough for cloud-only users, while Entra ID P1 is the least-cost dedicated license for hybrid SSPR with writeback. Microsoft Entra ID P2 is unnecessary because risk-based identity protection features are not required.

Explanation:

Explanation:

Box 1: Rule1 tip only
File1 matches Rule1, Rule2, and Rule3.
Rule1 has the highest priority.
Note: The Priority parameter specifies a priority value for the policy that determines the order of policy processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and policies can ' t have the same priority value.
Box 2: Rule1 tip only
Note: User Override support
The option to override is per rule, and it overrides all of the actions in the rule (except sending a notification, which can ' t be overridden).
It ' s possible for content to match several rules in a DLP policy or several different DLP policies, but only the policy tip from the most restrictive, highest-priority rule will be shown (including policies in Test mode). For example, a policy tip from a rule that blocks access to content will be shown over a policy tip from a rule that simply sends a notification. This prevents people from seeing a cascade of policy tips.
If the policy tips in the most restrictive rule allow people to override the rule, then overriding this rule also overrides any other rules that the content matched.
Reference:
https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-overview-plan-for-dlp
https://learn.microsoft.com/en-us/microsoft-365/compliance/use-notifications-and-policy-tips