You work for MDFT Pro, a well-known training agency, that is designing a large Azure environment which will contain many subscriptions.
You plan to use Azure Policy as part of a governance solution.
To which three scopes can you assign Azure Policy definitions?
Azure Active Directory (Azure AD) administrative units is incorrect. Azure AD administrative units are used to organize users and groups for administrative delegation, not as a scope for Azure Policy assignments.
compute resources is incorrect. Individual compute resources are not a supported scope for Azure Policy assignments at the resource level (only management groups, subscriptions, and resource groups are valid assignment scopes).
management groups is correct. Management groups are a supported scope for Azure Policy assignments, allowing policies to be inherited by all subscriptions and resource groups beneath them.
Azure Active Directory (Azure AD) tenants is incorrect. Azure AD tenants are identity boundaries, not a scope where Azure Policy can be assigned; Azure Policy operates on the Azure resource management plane, not the identity plane.
subscriptions is correct. Subscriptions are a supported scope for Azure Policy assignments; policies assigned at the subscription level apply to all resource groups and resources within it.
resource groups is correct. Resource groups are a supported scope for Azure Policy assignments; policies can be applied directly to a resource group to govern the resources within it.