By configuring the session hosts as hybrid Azure AD-joined, you can use Microsoft EndPoint Manager to manage security updates on the session hosts. Hybrid Azure AD join is a feature that allows devices to be joined to both on-premises Active Directory and Azure AD. This enables device management scenarios such as remote wipe, device compliance, and conditional access. Once the session hosts are hybrid Azure AD- joined, you can use Microsoft EndPoint Manager to manage security updates on the session hosts.