Two environments have legal requirements that their operational logs remain in different Azure regions with separate administration. What should guide the Log Analytics workspace design?

1. Disable logging to avoid designing access controls
2. Separate workspaces where required by residency and access boundaries
3. Rely only on resource tags to separate stored log residency
4. Always force all logs into one global workspace regardless of requirements