Which governance tool enforces that resources are deployed only to allowed Azure regions for a healthcare organization?

Azure Policy is the correct answer because it allows you to create, assign, and manage policies that enforce rules and effects over your resources to ensure they comply with your corporate standards and service level agreements. In this scenario, you would create a policy definition that restricts resource deployment to specific Azure regions. Azure Cost Management helps you understand your Azure spending, but it doesn't enforce deployment rules. Azure Resource Graph provides efficient resource exploration at scale, allowing you to query resources across subscriptions, but it doesn't govern deployments. Azure Monitor collects and analyzes telemetry from your Azure and on-premises environments, but it's for monitoring, not for enforcing resource deployment locations.