A global enterprise must enforce data residency by restricting resources to specific Azure regions. Which tool should they use?

Azure Policy is the correct choice because it allows you to define and enforce standards and compliance rules across your Azure resources. You can create policies that restrict resource deployment to specific Azure regions, ensuring data residency requirements are met. Azure Blueprints are used for deploying repeatable sets of Azure resources that adhere to organizational standards, but they don't enforce ongoing compliance like Policy does. Management Groups help organize subscriptions into hierarchies for governance at scale, but they don't directly enforce resource location. Azure Monitor is for collecting, analyzing, and acting on telemetry data from your Azure and on-premises environments, not for enforcing resource deployment rules.