Which Azure construct allows policies and access controls to be inherited according to an organization's hierarchy?

Management Groups are containers that help you manage access, policy, and compliance across multiple Azure subscriptions. They provide a level of organization above subscriptions, allowing you to apply policies and access controls at a higher level, which are then inherited by all subscriptions and resource groups within that management group hierarchy. This ensures consistent governance across your entire Azure estate. Resource Groups are logical containers for Azure resources, but they sit below subscriptions in the hierarchy and do not allow for policy inheritance across multiple subscriptions. Azure Subscriptions are a billing and administrative boundary, but they don't provide a way to group multiple subscriptions for policy inheritance. Azure Cost Management is a tool for analyzing and managing cloud spending, not for defining policy hierarchies.