You have a management group named MG1 that contains an Azure subscription named Sub1. Sub1 contains the resources shown in the following table. | Name | Description | |------------|-------------------

While resource groups contain servers, Microsoft Defender for Servers is not directly enabled at the resource group level; it's managed at the subscription or workspace scope.

Microsoft Defender for Servers can be enabled on a Log Analytics workspace. When enabled at this scope, all machines reporting to that workspace (including Azure VMs and on-premises servers) will be protected by Defender for Servers.

Microsoft Defender for Servers is typically enabled at the Azure subscription level. Enabling it here provides comprehensive protection for all existing and newly deployed virtual machines within that subscription.

Management groups provide governance over subscriptions but are not the direct scope for enabling security solutions like Defender for Servers.

Virtual networks facilitate communication for VMs but are not the scope at which Microsoft Defender for Servers is enabled.

Microsoft Defender for Servers is enabled at a higher scope (subscription or workspace) to protect multiple VMs, not on individual virtual machines directly.