Which Azure governance feature can enforce resource tagging and restrict allowed virtual machine sizes?

Azure Policy is the correct answer because it allows you to create, assign, and manage policies that enforce rules and effects over your resources. This includes enforcing resource tagging conventions (e.g., requiring specific tags) and restricting the types or sizes of resources that can be deployed (e.g., only allowing certain VM sizes). Azure Monitor is for collecting and analyzing telemetry data. Azure Resource Locks prevent accidental deletion or modification of resources but don't enforce configuration standards. Azure Blueprints orchestrate the deployment of various resource templates and policies, but Azure Policy is the underlying mechanism for enforcing the rules themselves.