Which solution lets a team centrally manage access across multiple Azure subscriptions?

Management Groups are the correct solution because they provide a level of hierarchy above subscriptions, allowing for centralized governance and access management across multiple subscriptions. You can apply policies and access controls at the management group level, and these settings are inherited by all subscriptions and resources within that group. Resource Groups are incorrect because they are containers for resources within a single subscription and do not provide cross-subscription management. Azure Roles define permissions for specific actions but don't inherently provide a hierarchical structure for managing access across subscriptions. Azure Active Directory (Azure AD) is the identity service that authenticates users and authorizes access, but Management Groups are the specific Azure construct for organizing and managing access policies across multiple subscriptions.