A company runs several virtual machines in an Azure virtual network. The security team needs to control outbound traffic by allowing connections only to a specific list of fully qualified domain names (FQDNs), such as *.contoso-updates.com, while centrally logging all traffic decisions across the network. Which Azure service should they deploy?