A company uses Microsoft 365. The company needs to remotely encrypt devices. You need to identify which solution meets the requirement. Which solution should you choose?

Microsoft Intune is a cloud-based MDM and Mobile Application Management (MAM) solution that can remotely push encryption policies to enrolled devices, such as enforcing BitLocker on Windows or FileVault on macOS. Intune allows administrators to configure device compliance policies and encryption settings that are applied remotely across managed endpoints. This makes it the correct choice for remotely encrypting devices at scale.

Retention labels are used to manage the lifecycle of data in Microsoft 365 services (e.g., SharePoint, Exchange) for compliance purposes, not for encrypting physical or virtual devices.

Azure Information Protection scanner is used to discover, classify, and protect files stored on on-premises file servers and SharePoint, not to encrypt devices remotely.

Sensitivity labels are used to classify and protect documents and emails by applying encryption and access controls to content, not to remotely encrypt entire devices.