Which tool can automate stopping a VM if CPU usage drops below 5% for one hour?

Azure Monitor with an Action Group is the correct choice because it allows you to create alert rules based on metrics like CPU usage. When the CPU usage drops below 5% for an hour, the alert rule triggers, and the associated Action Group can execute an automated action, such as stopping the VM via an Azure Automation runbook or a webhook to a logic app. Azure Advisor provides recommendations but doesn't automate actions. Azure Policy enforces organizational standards and compliance but isn't designed for dynamic, metric-driven automation like stopping a VM based on performance. Azure Sentinel is a Security Information and Event Management (SIEM) solution focused on security threat detection and response, not general resource automation.