AZ104-Q: restrict a region across subscriptions
All subscriptions under one business unit must deploy resources only in approved regions. What should the administrator use?
- A) A Contributor assignment on each resource group.
- B) An Azure Policy assignment at the business unit’s management-group scope. ✓
- C) A tag applied after every deployment.
- D) A CanNotDelete lock on every resource. Answer: B. Policy enforces compliant resource configuration across inherited scopes. Why not the others: RBAC, tags, and delete locks do not enforce allowed regions.