Microsoft Defender for Endpoint includes application control policies that allow you to define which applications are authorized to run on a machine.
This can help block any unauthorized applications and provide an approval mechanism, ensuring that only approved software is allowed to run.
The solution aligns with the requirement to block unauthorized applications from running on the virtual machines automatically until approved by an administrator.