A company has approximately 200 remote employees who need secure, encrypted access to virtual machines in an Azure virtual network. Employees work from home on managed Windows laptops and connect intermittently from dynamic IP addresses. The company does not have a dedicated on-premises data center and does not want to manage physical VPN appliances or provision static circuits. The solution must minimize infrastructure management while providing per-user secure connectivity. Which connectivity option should you recommend?