A company runs virtual machines, storage accounts, and SQL databases across several Azure subscriptions. The security team wants a single tool that continuously assesses their resources against security best practices, provides a secure score, and generates actionable recommendations to reduce risk. Which Azure service should they use?