A company has 40 Azure subscriptions under several management groups. The chief information security officer wants one measurable security posture score across all of them, a ranked list of recommendations that shows which fixes improve the score most, and a way to compare business units at management group level.