Question

Contoso has 40 Azure subscriptions used by three business units: Retail, Finance, and R&D. The compliance team must enforce a policy that blocks the creation of resources outside approved regions across all current and future subscriptions, while still allowing each business unit's platform team to apply unit-specific policies. The design must minimize the number of policy assignments and ensure new subscriptions automatically inherit the region restriction. What should you recommend?

Accepted Answer

Assign the allowed-locations Azure Policy at the root (Tenant Root) management group, and create child management groups per business unit for their specific assignments.

Answer

Assign the allowed-locations Azure Policy individually to each of the 40 subscriptions and add new subscriptions to the assignment as they are created.

Answer

Assign the allowed-locations Azure Policy to a single resource group in each subscription and use Azure Blueprints to replicate it.

Answer

Create an Azure RBAC custom role that denies resource creation in non-approved regions and assign it at each subscription scope.