We are looking to force all Azure access assignments to go through our management groups instead of at the subscription level. Basically we don't want access to be able to be assigned per subscription and want to block that capability. This way we are forced to grant access at the Management Group level instead.
Is there any way to do this, maybe via a Policy somehow?
Thanks for the helping!