A security architect must protect a sanctioned Microsoft 365 tenant. The requirement is to scan data already stored in SharePoint Online and OneDrive for sensitive files and malware, apply remediation to historical content, and do so without redirecting user traffic through a proxy or requiring endpoint agents. Which cloud security deployment approach meets these requirements?