You will deploy a personal host pool of 15 Windows 10 Enterprise VMs joined to the on-prem AD for users in domain group Department1. Ensure each user is automatically added to the local Administrators group on the VM they sign in to. What should you configure?

To automatically add users to the local Administrators group on their assigned Windows 10 Enterprise VMs, you should configure a policy preference in a Group Policy Object (GPO). Since the VMs are joined to an on-premises Active Directory, GPOs are the standard and most efficient method for managing user and computer settings across multiple machines. You would create a GPO, link it to the Organizational Unit (OU) containing the computer objects for your host pool VMs, and configure a Restricted Groups or Local Users and Groups preference to add the Department1 user group to the local Administrators group. Role assignments (options A and B) control access to Azure resources, not local group membership within the operating system. Azure AD device settings (option D) are for managing devices within Azure Active Directory and do not directly control local group membership on domain-joined Windows machines.