A county wants a convenient scope where role assignments and Azure Policy can cover many resource groups at once for a whole workload estate. Which scope often serves that management purpose?
Select an answer to reveal the explanation.
Short Explanation
When you need one place to hang permissions and policy for a big set of related groups, the subscription is the usual hook. You can still go narrower later, but subscription scope covers the estate in one swing.
Full Explanation
Azure role assignments and Azure Policy can be attached at several scopes, and for a county that wants one convenient scope covering many resource groups across a whole workload estate, the subscription is the common management hook. Assigning access or policy at subscription scope applies across the resource groups and resources that subscription contains, which is why subscriptions frequently serve both billing and governance purposes at Fundamentals depth.
Limiting the answer to a single disk SKU fails because a disk is a resource, not a broad management scope for many groups. Limiting RBAC to only a public IP address object similarly understates how high scope can go—public IPs are resources, not the estate-wide control point. A temporary blob snapshot name is metadata around a storage object; snapshots do not become the inheritance root for citywide policy.
Exam caveat: management groups sit above subscriptions and can apply policy and access even more broadly when multiple subscriptions must share governance; subscription scope is “common,” not the only higher scope. Operational check: when granting a county operations team rights to an estate, prefer a subscription-scoped role assignment (least privilege within that estate) and validate with a test user that resource groups under the subscription inherit the intended effective permissions without granting tenant-wide rights.