You plan to use VM insights in Azure Monitor to monitor 500 on-premises Windows servers and will onboard them to Azure Arc using the template script. To satisfy least privilege and reduce admin work, what should you create first?

Creating a Microsoft Entra service principal is the correct first step. When onboarding servers to Azure Arc using a template script, the script needs permissions to interact with Azure resources. A service principal provides an identity for applications, services, and automation tools to access Azure resources securely and with least privilege, without using a user's credentials. Generating a Log Analytics key or downloading the Log Analytics workspace ID are steps that come later, after the servers are onboarded and you are configuring the monitoring agent. A group managed service account (gMSA) is used for service accounts within an Active Directory domain, not for authenticating to Azure services from on-premises servers.