Your organization runs a pooled AVD host pool for finance staff. Security requires that the session hosts be hardened against ransomware that attempts to modify or encrypt files in users' FSLogix-mounted profile folders and known application data directories. You must enable a Microsoft Defender feature that blocks untrusted processes from writing to protected folders, while still allowing your approved line-of-business application to save files there. What should you configure?