An organization is deploying new workloads in Azure and needs to establish a management boundary for several development teams. The organization has the following requirements: - Group multiple resource groups together under a single billing unit to generate isolated invoices. - Apply security access permissions (Azure RBAC) and compliance rules (Azure Policy) that automatically inherit down to all contained resource groups. - Maintain a trust relationship with the organization's Microsoft Entra tenant for user authentication. Which Azure architectural component meets these requirements?

Azure subscription: ### What an Azure Subscription Is An **Azure subscription** is a logical container and foundational building block in Azure that links user accounts to the cloud resources they provision. It functions as both a primary **billing boundary** and an administrative **access and governance boundary** within the Azure resource hierarchy. ### How It Meets the Requirements - **Billing Boundary**: Each Azure subscription generates its own separate billing reports and invoices, allowing organizations to separate and track costs across departments, environments, or projects. - **Resource Group Container**: A single subscription holds multiple **resource groups**, providing a parent scope where policies and access permissions can be applied uniformly. - **Inherited Governance and Access**: Assigning **Azure role-based access control (Azure RBAC)** roles and **Azure Policy** definitions at the subscription scope ensures that all child resource groups and resources automatically inherit these permissions and compliance controls. - **Identity Integration**: Every subscription has an established trust relationship with a single **Microsoft Entra tenant** (directory) to handle identity authentication and authorization for administrators and service principals. ### Key Advantages and Capabilities - **Cost segregation**: Enables precise chargeback and showback by generating isolated invoices per subscription. - **Scalable administration**: Simplifies permission management by applying role assignments at a single scope above multiple resource groups. - **Enforced compliance**: Audits and restricts configuration settings across all contained resources using centralized policy assignments. - **Defined resource quotas**: Enforces specific scale limits and service quotas independently per subscription. ### Why This Is Optimal An Azure subscription sits directly above resource groups in the management hierarchy, making it the exact architectural unit designed to aggregate resource groups, isolate billing invoices, and cascade access controls downward.