You need to prevent nonprivileged Azure AD users from creating service principals. Which setting in the Azure AD admin center should you change?

The correct option is to set "Users can register applications" to "No" on the User settings blade. This setting directly controls whether non-admin users can register applications in Azure AD. When a user registers an application, a service principal is automatically created for that application. By disabling this setting, you prevent nonprivileged users from performing this action, thereby stopping them from creating service principals. "Access management for Azure resources" on the Properties blade controls who can manage access to Azure resources, not the creation of service principals. "Restrict access to Azure AD administration portal" limits user access to the Azure AD portal itself, but doesn't prevent programmatic creation of service principals if application registration is still allowed. "Enable Security defaults" enforces basic security policies but does not specifically restrict application registration by default users.