A bank's security team must enforce an Azure Policy that restricts which regions can be used for new resources. All of the bank's subscriptions are organized under a single management group, and the policy must cover every subscription beneath it — including subscriptions added there later — with a single assignment. Where should the team assign the policy?

1. A. At each subscription individually, and repeat the assignment manually whenever a new subscription is created 💬 A
2. B. At each resource group, because Azure Policy can't be applied above the resource group scope 💬 B
3. C. At the region level, so the policy applies to every resource deployed in the regions the bank uses 💬 C
4. D. At the management group level, so every nested subscription, resource group, and resource inherits it, including subscriptions added later ✓ D

Reveal answer

Correct answer: At the management group level, so every nested subscription, resource group, and resource inherits it, including subscriptions added later

Reference: https://learn.microsoft.com/en-us/azure/governance/management-groups/overview