Contoso runs approximately 300 Azure resources across 12 subscriptions, including VMs, storage accounts, and SQL databases. The security team wants a single prioritized, quantifiable measure of the environment's security posture that gives specific, actionable hardening recommendations (such as enabling encryption or MFA) and lets them track improvement over time. They do not want to build custom KQL dashboards or manually correlate findings. Which Azure capability should you recommend?