Your company wants to check whether Azure virtual machines follow secure baseline configurations. Which service provides that assessment?

Microsoft Defender for Cloud provides unified security management and advanced threat protection across your hybrid cloud workloads. It continuously assesses the security posture of your Azure resources, including virtual machines, against security benchmarks and regulatory compliance standards. This allows you to identify and remediate deviations from secure baseline configurations. Azure Policy enforces organizational standards and assesses compliance at scale, but it doesn't provide the continuous security posture management and threat protection of Defender for Cloud. Azure Blueprints define a repeatable set of Azure resources that implement and adhere to an organization's standards, but it's for deployment, not ongoing assessment. Azure Resource Graph is a service that allows you to explore your Azure resources at scale, but it's a query service, not a security assessment tool.