An enterprise has several Azure subscriptions and wants to apply governance consistently above them. Which scope should it use?

1. A virtual machine availability set
2. A resource group inside one subscription
3. An individual network interface
4. Management group