A managed security service provider (MSSP) operates a security operations center that monitors 40 customer tenants, each with its own Microsoft Sentinel workspace. The MSSP wants to author detection analytics rules and hunting queries once and deploy them consistently across all customer workspaces, while allowing individual customers to retain ownership of their own data and grant scoped, revocable access to the MSSP analysts. Which combination of capabilities should the architect design to meet these requirements?