A healthcare company must ensure all storage accounts are encrypted. Which Azure governance feature enforces this across subscriptions?

Azure Policy is the correct answer because it allows you to define and enforce organizational standards and assess compliance at scale. You can create a policy definition that requires encryption for all storage accounts and then assign this policy to management groups, subscriptions, or resource groups. Azure Policy will then audit existing resources for compliance and prevent the creation of non-compliant new resources. Azure Monitor Alerts are used for notifying you about operational issues or changes in your Azure environment, not for enforcing configuration standards. Azure Resource Graph is a service for exploring and querying your Azure resources at scale, useful for inventory and discovery, but it doesn't enforce policies. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources, not for enforcing storage encryption.