How to Use Azure Policy to Restrict Resource Deployment to a Specific Region
A company has multiple Azure subscriptions for different departments. The IT team wants to ensure that all resources in a specific subscription are only deployed in the 'West Europe' region. Which Azure feature should they use to enforce this restriction?
Quick Answer
The answer is Azure Policy, the correct choice because it enables you to create and assign rules that enforce compliance across your Azure environment. By defining a policy that restricts allowed locations to 'West Europe' and assigning it to the subscription scope, Azure Policy will deny or audit any resource deployment that does not meet this geographic restriction, effectively controlling where resources can be created. On the AZ-900 exam, this scenario tests your understanding of governance features, often appearing as a question about enforcing organizational standards across multiple subscriptions. A common trap is confusing Azure Policy with Azure Blueprints or RBAC—remember that Policy enforces rules on resource properties like region, while Blueprints packages templates and RBAC controls who can act. For a quick memory tip, think “Policy polices the location” to recall that it governs where resources can be deployed.
⚠ Common exam trap
Many exam-takers confuse Azure Policy with Azure RBAC, mistakenly thinking that assigning a role like 'Contributor' can restrict deployment regions, when in fact RBAC only controls permissions and not resource configuration or compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules or effects on your resources. By defining a policy that restricts allowed locations to 'West Europe' and assigning it to the subscription scope, Azure Policy will deny or audit any resource deployment that does not comply with this geographic restriction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Azure Policy can enforce rules like allowed resource locations across a subscription or resource group.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC manages access to resources, not region restrictions.
When this WOULD be correct
A question asks: 'Which Azure feature should be used to grant a user permission to create virtual machines in a specific resource group?' Azure RBAC would be correct because it controls access to resources based on roles.
- ✗
Azure Blueprints
Why it's wrong here
Blueprints define a repeatable set of resources but do not directly enforce location restrictions.
When this WOULD be correct
A company needs to deploy a standardized environment that includes multiple resources (e.g., VMs, databases, networking) with consistent configurations and built-in policies across subscriptions. Azure Blueprints would be the correct answer because it packages artifacts like policies, role assignments, and ARM templates for repeatable deployment.
- ✗
Azure Resource Graph
Why it's wrong here
Resource Graph is for querying resources, not governance enforcement.
When this WOULD be correct
An exam question asks: 'You need to quickly find all virtual machines in your environment that are not using managed disks. Which Azure tool should you use?' Azure Resource Graph would be correct because it allows efficient querying across resources.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Azure Policy can enforce rules like allowed resource locations across a subscription or resource group.
✗Azure RBACWrong answer — click to see why▾
Why this is wrong here
Azure RBAC manages access control (who can perform actions on resources), not enforcement of deployment locations. It cannot restrict the region where resources are created.
★ When this WOULD be the correct answer
A question asks: 'Which Azure feature should be used to grant a user permission to create virtual machines in a specific resource group?' Azure RBAC would be correct because it controls access to resources based on roles.
Why candidates choose this
Candidates may confuse RBAC with policy enforcement, thinking that role assignments can restrict resource creation to specific regions, but RBAC only controls permissions, not configuration rules.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates and policies, but it does not enforce restrictions on its own; it relies on Azure Policy for enforcement. The question specifically asks for a feature to enforce a region restriction, which is a core function of Azure Policy.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment that includes multiple resources (e.g., VMs, databases, networking) with consistent configurations and built-in policies across subscriptions. Azure Blueprints would be the correct answer because it packages artifacts like policies, role assignments, and ARM templates for repeatable deployment.
Why candidates choose this
Candidates may confuse Blueprints with Policy because both are used for governance and can include policy definitions. They might think Blueprints can enforce restrictions directly, not realizing that enforcement is delegated to Azure Policy within the blueprint.
✗Azure Resource GraphWrong answer — click to see why▾
Why this is wrong here
Azure Resource Graph is a query tool for exploring and discovering resources across subscriptions, not for enforcing deployment restrictions like region constraints.
★ When this WOULD be the correct answer
An exam question asks: 'You need to quickly find all virtual machines in your environment that are not using managed disks. Which Azure tool should you use?' Azure Resource Graph would be correct because it allows efficient querying across resources.
Why candidates choose this
Candidates may confuse Resource Graph's ability to query resources with the ability to enforce rules, thinking it can restrict deployments based on query results.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?
medium- ✓ A.Azure Policy
- B.Azure Blueprints
- C.Management Groups
- D.Azure Role-Based Access Control (RBAC)
Why A: Azure Policy is correct because it enforces organizational standards by evaluating resources for compliance with defined rules, such as restricting allowed regions. By creating a policy definition that denies resource creation outside West Europe and assigning it at the management group scope, the restriction applies to all existing and future subscriptions within the tenant automatically.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.