A company wants to stop users from creating resources in any Azure region except East US and West US across all subscriptions. Which Azure feature should be used to enforce this requirement?

An Azure RBAC role assignment

RBAC controls who can perform actions, but it does not enforce allowed regions for deployments.

A CanNotDelete resource lock on the subscriptions

A lock prevents deletion or changes to locked resources, but it does not restrict which region new resources can use.

A tag inheritance rule on the management group

Tags help with organization and reporting, but they do not enforce deployment location compliance.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: An Azure Policy assignment with a Deny effect at the management group scope — Azure Policy is the correct tool because the requirement is about enforcing a configuration rule, not granting or removing access. A Deny effect blocks deployments that do not match the allowed location list. Assigning the policy at the management group scope ensures the rule applies consistently to all subscriptions beneath it, including future subscriptions that are added to the hierarchy. RBAC would only decide whether a user can deploy, not whether the deployment meets the location standard. Why others are wrong: RBAC can authorize actions, but it cannot enforce which Azure regions are allowed. A CanNotDelete lock protects existing resources from deletion, not from being created in the wrong place. Tags are useful for reporting and governance, but they do not block noncompliant deployments by themselves. Only Azure Policy directly addresses resource configuration compliance in this scenario.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.