A company is deploying a new web application that consists of a virtual machine, a storage account, and a virtual network. The team wants to manage all of these resources as a single unit so they can apply access control together and delete everything at once when the project ends. Which Azure construct should they use to group these resources?