A cloud operations team has deployed dozens of resources across an Azure subscription and is concerned about insecure configurations, such as storage accounts that allow public access and virtual machines missing endpoint protection. They want a tool that continuously assesses these resources against security best practices and provides prioritized recommendations to reduce their attack surface. Which capability should they use?