You manage an on$-$premises network. You have a subscription that has a virtual network, Azure Virtual

Desktop host pool, and an Azure Firewall. The virtual network connects the on$-$premises network using

site$-$to$-$site VPN$.$ You want to make sure that only users in the on$-$premises network connect to the Azure

Virtual Desktop in the host pool. What should you do$?$