Fabrikam ' s plan is to use Azure Policy to enforce configuration management policies across both its Azure and on-premises servers. Azure Policy ' s guest configuration capability, which evaluates and can remediate in-guest settings, only works against a server that is registered as an Azure resource. For an on-premises or non-Azure server, that registration is achieved by deploying the Azure Connected Machine agent, which onboards the machine as an Azure Arc-enabled server, gives it an Azure resource ID, and makes it a valid target for Azure Policy assignments, including guest configuration policies, in exactly the same way an Azure VM would be. Hybrid joining servers to Microsoft Entra ID affects identity and device management (such as Conditional Access) but does not make a server a valid Azure Policy target. A hybrid runbook worker lets Azure Automation runbooks execute on-premises but is unrelated to Azure Policy enforcement. The Azure Monitor agent collects telemetry into Log Analytics and Azure Monitor but does not register the server as an Arc resource or enable policy assignment on its own; it is typically deployed after Arc onboarding, not instead of it. Deploying the Azure Connected Machine agent is therefore the correct first step.