An Admin wants to setup a policy to check devices for known PHAs during the enrollment process to prevent enrollment of devices with malware. What Google Security Service would the Admin use to accomplish this?

Verify Apps is the Google security service designed to scan apps on a device for potentially harmful applications (PHAs) during and after installation, including during the enrollment process. This directly addresses the admin's need to prevent devices with malware from enrolling. Chrome Safe Browsing protects users from malicious websites and downloads, not PHAs on the device itself. Verified Boot ensures the integrity of the device's operating system and firmware, but it doesn't scan for malicious user-installed applications. Clean Cache Detection is not a recognized Google security service for PHA detection.