Your organization has a management group hierarchy where the 'Production' management group has an Azure Policy assignment that denies the creation of public IP addresses. A subscription named 'App-Prod' is currently under a management group called 'Sandbox' that has no policy restrictions. To enforce the public IP restriction on 'App-Prod' with the least administrative effort, what should you do?