You manage a pooled Azure Virtual Desktop host pool running Windows 11 multi-session. Security requires you to reduce the attack surface by blocking Office applications from creating child processes and from injecting code into other processes, using the built-in Microsoft Defender Antivirus capabilities. You want to enforce this centrally without deploying third-party software. Which Defender feature should you configure on the session hosts?