Your company has 40 spoke VNets across three Azure regions that must all communicate directly with each other (any-to-any connectivity) without you manually creating and maintaining hundreds of individual peerings. As new spoke VNets are provisioned, they should automatically join this full-mesh topology if they carry a specific tag. You want the lowest-maintenance native solution. What should you implement?