A holding company organizes its Azure environment under a management group that contains multiple subscriptions. Governance staff want a single policy assignment that covers every subscription and all resources inside them — including resources created in the future. Where should the assignment be created?

1. A. At the management group scope, because all child subscriptions and their resources inherit the assignment ✓ A
2. B. At each subscription separately, because policy assignments are never inherited across scopes 💬 B
3. C. At each resource group, because policies apply only within the resource group where they're assigned 💬 C
4. D. At the individual resource scope, because Azure Policy evaluates resources one by one 💬 D

Reveal answer

Correct answer: At the management group scope, because all child subscriptions and their resources inherit the assignment

Reference: https://learn.microsoft.com/en-us/azure/governance/policy/overview