You need to enable developers to provision Azure virtual machines while enforcing the following constraints: they may create VMs only in specific Azure regions and only of specific VM sizes. Which Azure capability should you use to enforce these restrictions?

Azure Policy is the correct choice because it allows you to define and enforce organizational standards and assess compliance at scale. You can create policies to restrict VM creation to specific regions and to allow only certain VM sizes, ensuring compliance during resource deployment and for existing resources. ARM templates are used for declarative resource deployment but don't enforce ongoing compliance or restrictions on what can be deployed. Conditional Access policies are used for identity-based access control, not for resource deployment constraints. RBAC controls who can perform actions on resources, but it doesn't restrict the parameters (like region or VM size) of those actions.