Which mechanism should a compliance team use to restrict resource deployment to specific Azure regions?

Azure Policy is the correct mechanism because it allows you to define and enforce rules over your Azure resources, including restricting resource deployment to specific regions. You can create a policy definition that specifies allowed locations and then assign it to a scope (e.g., a subscription or resource group). Azure Locks prevent accidental deletion or modification but don't restrict deployment locations. Azure Tags are used for organizing and categorizing resources, not for enforcing deployment rules. Management Groups help organize subscriptions into hierarchies for governance but don't directly enforce resource deployment constraints; Azure Policy is applied within or across Management Groups.