Which service helps in discovering, classifying, labeling, and protecting sensitive information stored on on-premises file servers?

The Azure Information Protection (AIP) Scanner is specifically designed to discover, classify, label, and protect sensitive information stored on on-premises file servers. It integrates with your existing file servers, scanning their contents to identify sensitive data based on specific criteria set by your organization, such as patterns or metadata. Once the sensitive information is found, it can automatically apply the necessary labels and protections, ensuring that data is handled according to your organization's compliance and security policies.

By using the AIP Scanner, organizations can effectively manage their sensitive information, even when stored on local servers, leveraging capabilities that extend beyond just cloud-based environments. This process of continuous scanning helps organizations maintain control over their data and ensure compliance with regulations that may mandate protective measures for sensitive information.

In contrast, other options like Data Loss Prevention primarily focus on preventing unauthorized sharing or access to sensitive data, rather than discovering and classifying it. Retention Policy Management is more concerned with how long data should be retained or deleted, and the Intelligent Classification System deals with automated classification based on machine learning but doesn't directly interact with on-premises servers in the same manner as the AIP Scanner. Thus, the AIP Scanner stands out as the most appropriate service for the tasks mentioned.