The correct setting is Enforce attestation. In Microsoft Entra ID authentication methods policy, passkeys
/FIDO2 can be configured so that attestation is required during registration. Microsoft states that when Enforce attestation is set to Yes, attestation is required at registration time, and Microsoft Entra ID can verify the authenticator's make and model against trusted metadata. This is exactly what the question asks for:
validating the passkey during enrollment by using trusted metadata from the FIDO ecosystem.
Microsoft also explains that Microsoft relies on the FIDO Alliance Metadata Service (MDS) to determine passkey/FIDO2 authenticator compatibility, and that vendors publish authenticator metadata to the FIDO MDS. When attestation is enforced, Microsoft requires extra metadata from passkeys registered with the tenant, allowing Microsoft Entra ID to validate whether the authenticator meets attestation requirements.
Enforce key restrictions is different: it allows or blocks specific passkey models or providers by AAGUID.
Allow self-service setup only permits users to register passkeys themselves. Restrict specific keys is not the setting that performs FIDO MDS verification during enrollment. References/topics: Microsoft Entra authentication methods policy, Passkey/FIDO2 configuration, FIDO2 attestation, FIDO Alliance Metadata Service.

Explanation:

Reference:
https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-create

Explanation:

Box 1: The email will be blocked, and the user will receive the policy tip: Message blocked.
If you ' ve created DLP policies in the Exchange admin center, those policies will continue to work side by side with any policies for email that you create in the Security & Compliance Center. But note that rules created in the Exchange admin center take precedence. All Exchange mail flow rules are processed first, and then the DLP rules from the Security & Compliance Center are processed.
Box 2: The email will be allowed, and the user will receive the policy tip: Message contains sensitive data.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/how-dlp-works-between-admin-centers

Deploy Microsoft Entra ID Pass-through Authentication
Step 1: Check the prerequisites
Ensure that the following prerequisites are in place.
In the Entra admin center
1. Create a cloud-only Hybrid Identity Administrator account or a Hybrid Identity administrator account on your Microsoft Entra tenant. This way, you can manage the configuration of your tenant should your on- premises services fail or become unavailable.
(E) 2. Add one or more custom domain names to your Microsoft Entra tenant. Your users can sign in with one of these domain names.
(A) In your on-premises environment
1. Identify a server running Windows Server 2016 or later to run Microsoft Entra Connect Sync. If not enabled already, enable TLS 1.2 on the server. Add the server to the same Active Directory forest as the users whose passwords you need to validate. It should be noted that installation of Pass-Through Authentication agent on Windows Server Core versions is not supported.
2. Install the latest version of Microsoft Entra Connect Sync on the server identified in the preceding step. If you already have Microsoft Entra Connect Sync running, ensure that the version is supported.
3. Identify one or more additional servers (running Windows Server 2016 or later, with TLS 1.2 enabled) where you can run standalone Authentication Agents. These additional servers are needed to ensure the high availability of requests to sign in. Add the servers to the same Active Directory forest as the users whose passwords you need to validate.
4. Etc.
(B) Step 2: Enable the feature
Enable Pass-through Authentication through Microsoft Entra Connect Sync.
If you ' re installing Microsoft Entra Connect Sync for the first time, choose the custom installation path. At the User sign-in page, choose Pass-through Authentication as the Sign On method. On successful completion, a Pass-through Authentication Agent is installed on the same server as Microsoft Entra Connect Sync. In addition, the Pass-through Authentication feature is enabled on your tenant.
Incorrect:
Not C: From Active Directory Domains and Trusts, add a UPN suffix
Not D. Modify the email address attribute for each user account.
Not F. Modify the User logon name for each user account.
Reference:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-pta-quick-start