To enforce compliance automatically across all subscriptions, what should a security administrator apply at the management group level?

Azure Policy Assignments are the correct choice because they allow you to define and enforce rules (policies) across your Azure resources. Applying a policy assignment at the management group level ensures that all subscriptions and resources within that management group inherit and comply with the defined policies, providing automatic and consistent compliance enforcement. Resource Tags are used for organizing and categorizing resources, not for enforcing compliance rules. Azure Blueprints are used for deploying and managing environments, including policy assignments, but the direct enforcement mechanism is the policy assignment itself. Azure Monitor Alerts are for notifying administrators of specific events or conditions, not for enforcing compliance.