This seems to be referring to https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-in

This seems to be referring to https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#code-integrity-guard https://docs.microsoft.com/en-us/microsoft-365/security/defe... which would mean that they require the browser itself to be digitally signed, not the JS.