Secure Windows endpoints with on-premise architecture

Hello guys,

I'm currently writing a thesis related to Microsoft Security and I'm struggling with all the products offered by Microsoft to find some of them that can be used exclusively in an on-premise environment.

Those products should guarantee the security of Windows endpoints.

For the moment, this is what I have :

• Active Directory with Group Policies
• Virtual Dekstop Infrastructure (VDI)

Can you help me to figure this out ?

Thank you in advance !