A financial services company is designing a ransomware resiliency strategy for its Azure workloads and on-premises file servers. Recent threat intelligence shows attackers frequently attempt to delete or encrypt backups before triggering the primary ransomware payload. The security architect must ensure backup data cannot be modified or deleted by an attacker who compromises a privileged administrator account, while still meeting recovery time objectives. Which approach BEST addresses this requirement?