You need an at-scale inventory of all public IP addresses and their DDoS protection state across all subscriptions in a management group. Results must be near real-time without first ingesting data into a Log Analytics workspace. What should you use?

Azure Resource Graph (ARG) is the correct choice because it's designed for near real-time, at-scale querying of Azure resources across subscriptions. You can use KQL queries directly against ARG at the management group scope to get the required inventory, including DDoS protection state, without needing to ingest data into Log Analytics first. A Log Analytics KQL query against AzureActivity would show activity logs, not a current inventory of resources, and requires prior data ingestion. A PowerShell script looping through subscriptions would be slow, inefficient for at-scale inventory, and not near real-time. Azure Policy export focuses on compliance state and would require significant external processing to derive the inventory, making it less direct and real-time than ARG.