You use Azure Resource Manager templates to deploy Azure virtual machines and need to automatically disable unused Windows features as VMs are provisioned. Which solution should you use?

Azure Automation State Configuration (AASC) is the correct solution because it uses PowerShell Desired State Configuration (DSC) to define the desired state of servers, including Windows features. AASC can automatically apply and enforce these configurations during VM provisioning and continuously monitor for drift, ensuring unused features remain disabled. Microsoft Intune device configuration policies and device compliance policies are primarily designed for managing end-user devices (e.g., laptops, mobile phones) and their applications, not for configuring server-side Windows features during Azure VM provisioning. Azure Security Center's security policies focus on security recommendations and compliance assessments, not on the automated disabling of specific Windows features during deployment.