you are the administrator for an organization with 275 computers that all run windows 10. these computers are all joined to microsoft azure active and all computers are enrolled in microsoft intune with ems. you need to make sure that only approved applications are allowed to run on all of these computers. what should you implement to ensure this?