Your company's Azure subscription contains resources across multiple regions. You must ensure administrators can only create resources in those regions. What should you use?

An Azure Policy is the correct choice because it allows you to enforce rules and effects over your resources, ensuring compliance with your organization's standards. You can create a policy definition that restricts resource creation to a specific set of Azure regions. A read-only lock prevents modification or deletion of existing resources but doesn't restrict new resource creation. A management group helps organize subscriptions and apply policies at a higher level, but it's the Azure Policy itself that defines the restriction. A reservation is used to save money on compute costs by committing to a specific usage plan, not for enforcing regional restrictions.