An organization wants to ensure that all cloud resources are deployed only to approved geographic regions in order to satisfy regulatory and data residency standards. The Azure administrator needs to enforce this rule across an entire subscription using a pre-configured rule without writing custom JSON code. What should the administrator do to meet this requirement?

Assign a built-in Azure Policy definition to the subscription scope: ### What Azure Policy and Built-In Definitions Are **Azure Policy** is a dedicated governance service in Microsoft Azure that allows organizations to define, assess, and enforce corporate standards and regulatory compliance across their cloud environments. Azure Policy compares resource configurations against defined business logic. To accelerate governance, Azure provides **built-in policy definitions**—pre-configured rules created by Microsoft that address standard use cases such as enforcing naming conventions, requiring resource tags, or restricting deployments to allowed geographic locations. ### How It Meets the Requirement - **Pre-configured rules**: Azure includes a built-in policy definition named *Allowed locations* that enables administrators to select permitted regions from a list of parameters without writing custom JSON definitions. - **Scope-level enforcement**: Policy definitions can be assigned to various Resource Manager scopes, including **management groups**, **subscriptions**, **resource groups**, or individual resources. Assigning the policy at the subscription scope automatically applies the rule to all current and future deployments within that entire subscription. - **Preventive enforcement**: By setting the policy effect to `Deny`, Azure Resource Manager blocks any deployment request targeting an unapproved region during resource creation or update. ### Key Advantages and Capabilities - **Zero custom code required**: Pre-built policy templates eliminate the need to write and validate complex JSON schemas manually. - **Scalable governance**: Policies inherit down through the resource hierarchy, applying uniformly across all resource groups under the assigned subscription. - **Real-time evaluation**: Evaluates requests immediately when resources are created or updated, preventing non-compliant deployments before they occur. - **Centralized visibility**: Provides a compliance dashboard displaying overall organizational compliance status. ### Why This Is Optimal Assigning a built-in policy is the native, intended method for enforcing cloud governance and resource configurations at scale across Azure scopes.

Azure Policy Assign Builtin Allowed Locations | Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!