Your organization runs a pooled AVD host pool with 30 multi-session Windows 11 Enterprise session hosts. The security team wants a continuous, prioritized inventory of software vulnerabilities and misconfigurations on the session hosts, along with remediation recommendations, surfaced in a central portal. They have already enabled Microsoft Defender for Servers Plan 2 on the subscription containing the session hosts. Which capability satisfies this requirement without deploying any additional third-party scanning agents?