Which Azure feature can automatically block virtual machine deployments that violate the company's allowed-region policy?

Azure Policy is the correct answer because it allows you to define and enforce organizational standards and assess compliance at scale. You can create policies, like an allowed-region policy, to prevent the creation of resources in unapproved regions. If a deployment violates this policy, Azure Policy will block it. Management groups help organize subscriptions into containers for governance, but they don't directly enforce deployment rules. Resource tags are used for organizing and categorizing resources, not for blocking deployments. Azure Advisor provides recommendations for optimizing Azure resources, but it does not enforce policies or block deployments.