You need to standardize new subscriptions for a data analytics platform. Baseline requirements include: deploy two resource groups, assign RBAC roles for platform ops, assign policies for allowed locations and diagnostic settings, and prevent deletion of baseline resources by subscription owners. What should you recommend?

Azure Blueprints are the ideal solution for standardizing new subscriptions by orchestrating the deployment of various Azure resources and configurations. They allow you to define a repeatable set of Azure resources, including Policy Assignments (for allowed locations and diagnostic settings), Role Assignments (for platform ops), and ARM Template deployments (for resource groups). The key feature here is the assignment lock, specifically DoNotDelete, which prevents even subscription owners from deleting baseline resources, directly addressing the requirement. An Azure Policy initiative alone cannot deploy resource groups or assign RBAC roles; it only enforces rules. ARM templates from a Template Spec can deploy resources but don't inherently provide the locking mechanism or the comprehensive orchestration of policies and roles in one assignment. Management Groups are for organizing subscriptions and applying policies, but they don't deploy resources or prevent deletion at the resource level in the way a Blueprint lock does. Deploying with Bicep and manually applying resource locks is a manual process and doesn't meet the standardization requirement for new subscriptions.