To ensure that only authorized applications can run on the virtual machines and to block unauthorized applications automatically until an administrator authorizes them, you should recommend:

D. Application control policies in Microsoft Defender for Endpoint

Microsoft Defender for Endpoint provides application control policies that allow you to define which applications are allowed or blocked on your Windows machines. You can create rules specifying which applications are authorized to run, and any application that doesn't match these rules can be automatically blocked. This provides a strong layer of security and control over the applications running on your virtual machines.