You have a Microsoft Entra tenant named contoso.

You have a Microsoft Entra tenant named contoso.com. You have 30 Azure subscriptions that are linked to contoso.com. The tenant contains the management groups shown in the following table.

You need to design a governance solution to manage access to all the Azure Storage accounts across the subscriptions. The solution must meet the following requirements:

• Use custom role-based access control (RBAQ to provide granular access to control plane and data plane operations.

• Minimize administrative effort.

At which scope should you assign the roles, and what is the minimum number of assignments per role? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.