Contoso operates three separate Microsoft Entra tenants after two acquisitions, each with its own Azure subscriptions and Log Analytics workspaces. The central security operations team needs a single pane to run KQL queries across activity logs, security events, and Defender alerts from all three tenants without migrating subscriptions or duplicating log ingestion. They also want to minimize custom code and ongoing maintenance. What should you recommend?