Your organization must audit Azure Activity Logs for several subscriptions that belong to the same tenant. Which scope should you use when configuring diagnostic settings to capture all subscription‑level activity with a single configuration?
A. Enable diagnostic settings at the tenant level so Activity Logs for all subscriptions under the tenant are captured centrally into chosen destinations.
B. Enable diagnostic settings individually on each subscription because tenant-level diagnostic settings do not exist for Activity Logs across subscriptions.
C. Enable diagnostic settings per resource group because subscription-level events are not available at the tenant scope and must be mapped to resource groups.
D. Enable diagnostic settings only on individual resources because subscription and tenant levels do not emit Activity Logs for auditing purposes.
Diagnostic settings for Activity Logs cannot be applied at the tenant level; you must enable them individually for each subscription.