Question

Your company has a compliance requirement that all Azure resources must be deployed only in the West Europe and North Europe regions. You need to prevent users from creating resources in any other region across an entire subscription, with the least administrative effort. What should you do?

Accepted Answer

Assign the built-in 'Allowed locations' Azure Policy definition at the subscription scope and configure the allowed regions parameter.

Answer

Create a resource lock of type ReadOnly on the subscription to block deployments in other regions.

Answer

Assign the Reader RBAC role to all users at the subscription scope so they cannot create resources outside the approved regions.

Answer

Apply a tag named 'region' with allowed values to the subscription and enforce it through Azure Advisor.