Which Azure service enforces rules like "deny VMs in unsupported regions"?

Azure Policy is the correct answer because it allows you to create, assign, and manage policies that enforce rules and effects over your resources to ensure compliance with corporate standards and service level agreements. For example, you can use Azure Policy to deny the creation of virtual machines in specific regions. Azure Blueprints define a repeatable set of Azure resources that implement and adhere to standards, patterns, and requirements, but don't enforce rules dynamically. Azure Tags are used for organizing resources, not enforcing rules. Azure Monitor collects and analyzes telemetry data from your Azure and on-premises environments to maximize their performance and availability, but it doesn't enforce resource creation rules.