You create a custom role named Role1 for the contoso.com Azure AD tenant. At which scopes can Role1 be used for delegating permissions?

Custom Azure AD roles are tenant-wide and can only be assigned at the tenant scope. This means Role1 can be used to delegate permissions for resources within the entire contoso.com tenant. They cannot be scoped down to individual subscriptions (like Subscription1) or resource groups (like RG1) within that tenant. Azure RBAC custom roles, on the other hand, can be scoped to subscriptions and resource groups. The question specifically refers to a custom role for an Azure AD tenant, indicating an Azure AD custom role, not an Azure RBAC custom role.