Explanation:

To enforce compliance for Defender for Endpoint by using Conditional Access, you need to configure an Intune connection in the Defender for Endpoint portal. This allows you to use Intune device compliance policies to evaluate the health and compliance status of devices that are enrolled in Defender for Endpoint.
You can then use Conditional Access policies to block or allow access to cloud apps based on the device compliance status. References: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft- defender-atp/conditional-access To prevent suspicious scripts from running on devices, you need to configure an attack surface reduction (ASR) rule in Intune. ASR rules are part of the endpoint protection settings that you can apply to devices by using device configuration profiles. You can use the ASR rule "Block Office applications from creating child processes" to prevent Office applications from launching child processes such as scripts or executables.
References: https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-protection-windows-10#attack- surface-reduction-asr-rules