A personal host pool contains 20 Azure AD–joined session hosts. To ensure only approved VM extensions are installed on those hosts while minimizing administration, which solution should you use?

Azure Policy is the correct solution because it allows you to define and enforce standards for resources, including restricting the installation of specific VM extensions. You can create a policy definition that audits or denies the deployment of unapproved extensions and assign it to your host pool's scope, ensuring compliance with minimal ongoing administration. ARM templates are used for deploying resources, not for enforcing ongoing configuration or security policies after deployment. Windows Admin Center is a management tool for individual Windows servers, not a centralized policy enforcement mechanism for multiple Azure VMs. Group Policy is a traditional on-premises management tool for Windows domains and is not natively integrated for managing Azure AD-joined VMs in this manner.