Which service can filter network traffic across multiple Azure subscriptions and virtual networks?

Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a stateful firewall as a service with built-in high availability and unrestricted cloud scalability. Crucially, it can filter traffic across multiple Azure subscriptions and virtual networks, providing centralized security policy enforcement. Application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, grouping VMs and defining network security policies based on those groups. They operate at a more granular level within a virtual network. Azure DDoS Protection provides enhanced DDoS mitigation capabilities for your Azure resources. Network security groups (NSGs) filter network traffic to and from Azure resources in an Azure Virtual Network. They operate at the subnet or NIC level within a single virtual network, not across multiple subscriptions or virtual networks.