You operate 300 on-premises Windows Server machines that are Arc-enabled. Leadership wants a consistent, Microsoft-recommended baseline applied and kept compliant with minimal manual configuration of underlying services (monitoring, updates, security). What should you implement?

The correct answer is to create an Automanage account and assign the Azure Best Practices Production configuration profile. Azure Automanage for Windows Server is specifically designed to onboard servers to Azure services like Update Management, Azure Monitor, Microsoft Defender for Cloud, and Azure Backup, applying Microsoft-recommended best practices automatically and maintaining compliance with minimal effort. This directly addresses the need for a consistent, Microsoft-recommended baseline with minimal manual configuration. Azure Automation Desired State Configuration (DSC) would require significant manual authoring and maintenance of custom configurations, which contradicts the goal of minimal manual configuration. System Center Configuration Manager (SCCM) baselines and co-management are an on-premises solution that doesn't fully leverage Azure's automated best practices for Arc-enabled servers and would require more management overhead. An Azure Policy initiative that only audits would identify non-compliance but wouldn't automatically apply or remediate the desired configurations, failing to meet the requirement for a applied and kept compliant baseline.