Your organization wants to build a custom Azure Monitor workbook that visualizes Intune device enrollment failures and operational trends over the past 90 days. The security team requires that the underlying Intune audit and operational log data be queryable with KQL and retained beyond the default reporting period. What must you configure first before the workbook can query this data?