Defender for Endpoint response actions: isolate vs contain

This sheet compares Full isolation, Selective isolation, Contain device, Restrict app execution, Run antivirus scan.

CriterionFull isolationSelective isolationContain deviceRestrict app executionRun antivirus scan
TargetOnboarded deviceOnboarded deviceUnmanaged deviceOnboarded deviceOnboarded device

The verdict, the full comparison, 3 rules and 2 traps are part of SC-200 access. Unlock SC-200.