A financial services company must provision new project environments that consistently include a standard set of resource groups, role assignments, Azure Policy assignments, and ARM template deployments to meet regulatory requirements. They want to package all of these artifacts together so that each new subscription can be set up in a repeatable, compliant way. Which Azure service should they use?