In Prisma Cloud for Azure Net Effective Permissions Calculation, the following Azure permission levels are supported by which three permissions? (Choose three).

Prisma Cloud supports Net Effective Permissions calculation at three key Azure permission levels: Management Group, Subscription, and Resource Groups. These three levels form the primary hierarchical structure where Azure Role-Based Access Control (RBAC) assignments are made. Management Groups organize subscriptions, Subscriptions contain resource groups, and Resource Groups contain individual resources. While permissions ultimately affect resources, Prisma Cloud calculates effective permissions at these three organizational levels where role assignments are typically configured.

Option A (Resources): Individual resources inherit permissions from higher levels; they're not a primary calculation level.
Option B (Tenant): Tenant is the root level but not a standard RBAC assignment scope in this context.

1. Palo Alto Networks Prisma Cloud Administrator's Guide - Azure Integration section, Chapter on Permission Models

2. Microsoft Azure RBAC documentation - "Understand scope for Azure RBAC" (docs.microsoft.com/azure/role-based-access-control/scope-overview)

3. Palo Alto Networks Prisma Cloud Security Posture Management Guide - Azure Permissions section