Your company has a Microsoft $365$ E$5$ subscription and Windows $11$ devices enrolled in Microsoft Intune.

You create a compliance policy named Policy$1$ that has the following settings:

Device Health: Require BitLocker

Microsoft Defender for Endpoint: Require the device to be at or under the machine risk score: Medium

You need to ensure that only devices that comply with Policy$1$ can access email.

What should you configure?