You have an Azure Virtual Desktop personal host pool named Pool1 that contains 20 Azure AD-joined session hosts. You need to ensure that only approved virtual machine extensions are installed on the Pool 1 session hosts. The solution must minimize administrative effort. What should you use?