Your company has 300 subscriptions split across three divisions: Retail, Manufacturing, and R&D. You need to enforce an organization-wide policy that denies public IP creation, apply different allowed-location policies per division, grant tenant-wide Reader access to Auditors, and allow subscription owners to manage their own resources. What management group and assignment design should you implement?

This design effectively addresses all requirements. A hierarchical structure (Root - Corp - Divisions) allows for centralized policy enforcement and granular control. Denying public IP creation at the Corp management group ensures it applies to all divisions without needing individual assignments. Division-specific allowed locations are applied precisely where needed. Granting Reader access to auditors at the Root management group provides tenant-wide visibility. Allowing subscription owners to manage their resources is the default behavior and doesn't require additional management group policy assignments. Incorrect options: A flat hierarchy is unmanageable and doesn't allow for efficient policy inheritance. Assigning policies at the resource group level is too granular and doesn't scale for 300 subscriptions and organization-wide policies. Azure Lighthouse is for managing resources across multiple tenants, not for internal policy enforcement within a single tenant. Assigning all policies at Root would apply the same allowed locations to all divisions, which contradicts the requirement for division-specific policies.