A county public-health analytics team must place a new Azure Machine Learning workspace so it inherits the same billing, policy, and network controls used for other HIPAA-scoped civic workloads. Where should the workspace be created?

Placing the new Azure Machine Learning workspace in the Azure subscription and resource group already used for the county's governed civic workloads is correct because those scopes already carry the billing hierarchy, Azure Policy assignments, network controls, and operational ownership expected for HIPAA-scoped public-health analytics. Inheritance of tags, locks, private networking patterns, and cost centers happens at subscription and resource-group placement time; putting the workspace there keeps MLOps inside the same compliance neighborhood as other civic systems rather than inventing a parallel unmanaged path.

In the Azure subscription used for the county's governed civic workloads in an analytics resource group fails because, while the subscription billing and policy scope is correct, a different resource group breaks resource-group-level inheritance; the workspace would not automatically receive the tags, locks, private networking patterns, and operational ownership of the existing governed civic resource group. In the Azure subscription and resource group already used for the county's governed administrative workloads likewise cannot host governed civic AI: administrative billing, policy, and network controls are not the HIPAA-scoped civic scope required, so the workspace would not inherit the specific compliance neighborhood of the county's governed civic workloads. In a child Azure subscription under the management group for the county's governed civic workloads fails because a separate child subscription gets its own billing, policy assignment scope, and network controls; even under the same management group, the workspace would not inherit the same subscription-level cost centers, Azure Policy assignments, and private networking patterns as other HIPAA-scoped civic workloads.

Exam caveat: workspace region and resource-group placement are separate decisions from compute SKU or datastore type. When the stem emphasizes billing, policy, and network inheritance, answer with the existing governed subscription/resource-group placement—not with an analytics resource group in the same civic subscription, the governed administrative subscription and resource group, or a child subscription under the civic management group.

Operational check: verify the workspace resource ID shows the expected subscription and resource group, confirm policy compliance state is healthy, and validate that private endpoints or NSG patterns used for other HIPAA civic workloads also apply to this workspace.