A healthcare company is migrating a workload that processes highly sensitive patient records to Azure IaaS virtual machines. Compliance requires that data must be protected not only at rest and in transit, but also while it is being processed in memory, and the company wants hardware-based isolation that prevents the hypervisor and Azure operators from accessing the workload's memory. Which compute option should you recommend?