The correct options are Subscription, Management group, and Resource group.

Subscription is a primary billing and access boundary in Azure and you can assign roles at the subscription level to grant permissions across all resources within that subscription.

Management group lets you group subscriptions together and assign roles at that higher level so policies and access can be applied consistently across multiple subscriptions.

Resource group is a logical container for related resources and assigning roles at the resource group level scopes permissions to only the resources in that group.

Azure region is not a valid scope for role assignments because regions denote physical locations and Azure RBAC does not operate at the region level. Roles are assigned at the Management group, Subscription, Resource group, or individual resource level instead.

Full AWS Practitioner Certification Question