Office365 as a Conditional Policy Resource

When I create CA-Policy around Office365 as a cloud-resource,  which exact resource we are protecting ?

Are we protecting  MS-Graph  as a resource which has APIs for various  office applications like Teams, SharePoint etc.

In other words we are protecting various  office356 APIs in MS-Graph

For eg.,  POST https://graph.microsoft.com/beta/sites/{site-id}/lists 

OR

Are we protecting all direct APIs exposed by Teams, SharePoint, Exchange etc. ?

Something like for eg.,   POST https://microsoft.sharepoint-df.com/sites/{site-id}/lists      

Thanks.