Scope: where policies apply
Scope controls coverage—from one resource group to many subscriptions. Management group can span many subscriptions. Subscription covers all its resource groups. Resource group is a smaller rollout target. Exclusions allow carve-outs.