Your compliance team needs a weekly report across all subscriptions listing: 1) Public IP addresses not associated with any NIC, load balancer, or VM; 2) Changes to Network Security Groups (NSGs) that altered the number of security rules in the last 14 days. The solution should scale with minimal overhead and require no agents. What should you implement?

Azure Resource Graph is ideal for this scenario because it allows you to query across all subscriptions for resource properties and changes without agents. You can craft a query to identify public IPs not associated with network interfaces (NICs), load balancers, or VMs. Similarly, the resourcechanges table in Resource Graph can track changes to NSGs, including alterations to the number of security rules over the last 14 days. A Logic App or Azure Automation runbook can then execute these queries weekly and email the results, providing an automated, scalable, and low-overhead solution. Exporting Activity Logs to Log Analytics is an option, but querying for "unattached" IPs would be complex as Activity Logs record events, not resource states. Azure Policy is for enforcement, not reporting on existing unattached resources, and Change Tracking is for VMs, not NSG rule changes. Azure Monitor Metrics track performance data, not resource configuration or changes. Exporting and diffing ARM templates is overly complex and inefficient for this reporting requirement.