Your organization needs to enforce two standards across all subscriptions under the Corp management group: (1) resources must have a CostCenter tag (auto-add a default when missing), and (2) resources must be deployed only in approved regions. Existing resources must be remediated where possible. What should you do? (Choose two)

The correct approach involves using Azure Policy. Creating custom or built-in policy definitions for "Required tags" with the Modify effect (to auto-add the default CostCenter tag) and "Allowed locations" (to restrict regions) addresses both requirements. Combining these into an initiative and assigning it at the Corp management group ensures enforcement across all subscriptions. The Modify effect requires a managed identity with appropriate permissions to perform remediation actions, such as adding tags to existing resources. Granting the managed identity the "Resource Policy Contributor" role at each subscription provides the necessary permissions for the policy to modify resources. Assigning at each resource group is inefficient and doesn't meet the "all subscriptions" requirement. Azure Blueprints can enforce standards but don't offer the same granular remediation capabilities as Azure Policy's Modify effect for existing resources. Activity Log alerts only detect non-compliance; they don't enforce or remediate.