In the context of encrypting an Azure virtual machine named VM1 using Azure Disk Encryption, which foundational Azure resource is required to be set up initially to manage and control the encryption keys and secrets?