Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/overview

Explanation:
Box 1: Yes
Microsoft Defender for Cloud Apps is included in a Microsoft 365 E5 subscription. It's part of the broader security suite offered with the E5 license, which also includes Defender for Endpoint, Defender for Identity, and Defender for Office 365.
Box 2: Yes
Microsoft Defender for Cloud includes Cloud Security Posture Management (CSPM) capabilities, offering a way to assess and improve the security posture of your cloud resources. It provides a comprehensive view of your cloud environment, identifying potential vulnerabilities and offering guidance to remediate them.
Box 3: Yes
Microsoft Defender for Cloud can be used for vulnerability scans of virtual machines. Specifically, the Defender for Servers plan in Defender for Cloud provides vulnerability scanning for connected machines, including Azure VMs, AWS and GCP machines, and on-premises VMs onboarded as Azure Arc VMs.
Reference:
https://www.microsoft.com/en-us/microsoft-365/enterprise/e5
https://azure.microsoft.com/en-us/products/defender-for-cloud
https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment

Explanation
Graphical user interface, text, application, Word Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization