Enable Defender for Servers Plan 1 on selected machines
Use resource-level Defender for Servers Plan 1 and built-in Azure Policy for selected machines.