You work for MDFT Pro, a well-known training agency, that is designing a large Azure environment which will contain many subscriptions.
You plan to use Azure Policy as part of a governance solution.
To which three scopes can you assign Azure Policy definitions?
Azure Active Directory (Azure AD) tenants is incorrect. Azure AD tenants are identity boundaries, not a scope where Azure Policy can be assigned; Azure Policy operates on the Azure resource management plane, not the identity plane.
Azure Active Directory (Azure AD) administrative units is incorrect. Azure AD administrative units are used to organize users and groups for administrative delegation, not as a scope for Azure Policy assignments.
subscriptions is correct. Subscriptions are a supported scope for Azure Policy assignments; policies assigned at the subscription level apply to all resource groups and resources within it.
resource groups is correct. Resource groups are a supported scope for Azure Policy assignments; policies can be applied directly to a resource group to govern the resources within it.
management groups is correct. Management groups are a supported scope for Azure Policy assignments, allowing policies to be inherited by all subscriptions and resource groups beneath them.
compute resources is incorrect. While individual resources are technically a valid Azure Policy assignment scope, management groups, subscriptions, and resource groups are the three primary governance scopes used for applying policies at scale in a large Azure environment.