Your company runs an Azure Firewall Premium with a firewall policy that contains dozens of network and application rules. Several rules reference the same set of 40 on-premises subnet CIDRs as their source, and this list changes about twice a month. Each time it changes, an engineer must manually edit every affected rule, which is error-prone. You need to centralize this address list so a single update propagates to all rules that use it, while keeping the change scoped to the firewall configuration. What should you implement?