A financial services company must be able to audit every create, update, and delete operation performed against Azure resources across all subscriptions, including who initiated each operation and from what IP address. The security team needs these records retained for seven years in immutable storage and made searchable for compliance investigations. Which logging source should be the primary basis for capturing this control-plane audit information?