A solutions architect must enforce security configuration standards across every subscription within a management group before resources reach production. Which Azure capability lets them assign built-in definitions and initiatives at management group scope to accomplish this?