You need to provide developers with the ability to provision Azure virtual machines while enforcing these constraints: only allow creation in specific regions, and only allow creation of specific VM sizes. Which Azure capability should you use?

Azure Policy is the correct choice because it allows you to define and enforce organizational standards and assess compliance at scale. You can create policies to restrict resource creation to specific Azure regions and to allow only specific VM sizes, directly addressing both requirements. ABAC is an extension of RBAC, offering fine-grained control based on attributes, but Azure Policy is designed for enforcing organizational governance rules across resources. Conditional Access policies are used for controlling access to applications based on user, device, and location conditions, not for enforcing resource deployment constraints. RBAC grants or denies permissions to perform actions on resources but doesn't enforce rules about what resources can be deployed or where.