Your company runs a pooled, multi-session Azure Virtual Desktop host pool used by call center staff. Security requires that only a curated set of signed, IT-approved applications may execute on the session hosts, and any unapproved executable, script, or installer must be blocked automatically — including software users might download. The solution must be enforced at the Windows kernel level and centrally managed. Which Windows threat protection feature should you implement on the session hosts?