Your organization has hundreds of virtual machines already deployed across multiple subscriptions. A new compliance requirement mandates that all VMs must have a specific monitoring agent installed. You need a tool that can not only report which existing VMs are non-compliant but also automatically deploy the missing agent to bring them into compliance. Which Azure governance feature should you use?