Security wants NSG rules based on logical application tiers rather than listing every VM's private IP. Which capability fits?

1. Entra license groups only
2. Availability sets
3. Application security groups
4. Management groups