Your organization uses Microsoft Intune with Microsoft Defender Antivirus on all Windows 11 devices. Recently, a help-desk technician discovered that malware on an infected device had disabled real-time protection and modified exclusion settings before it was detected. Security leadership wants to ensure that neither local users nor malicious processes can alter Defender Antivirus core settings, even if they have local administrator rights. Which configuration should you deploy through Intune endpoint security to meet this requirement?