What is the best way to apply security policies consistently across multiple Azure subscriptions for a global enterprise?

Assigning policies at the management group level is the most effective way to ensure consistent security policies across multiple Azure subscriptions for a global enterprise. Management groups provide a hierarchical structure that allows you to organize subscriptions into containers, enabling inheritance of policies. This means a policy assigned to a management group automatically applies to all subscriptions and resources within that group and its child management groups. Assigning policies at the resource level would be impractical and error-prone for a global enterprise with many subscriptions and resources, as it requires individual assignment for each resource. Azure Tags are used for organizing and categorizing resources, not for enforcing policies. Azure Advisor provides recommendations for optimizing Azure resources but does not enforce policies.