Azure Policy is the correct feature for restriction. It is designed to enforce rules and compliance at scale. A specific policy definition, such as "Allowed virtual machine size SKUs," can be applied at a subscription level to restrict which VM types are permitted for deployment.

Azure tags are key-value pairs used to add metadata to resources. Their primary purpose is to organize and identify resources for management, billing, and reporting. A common use case is applying a "CostCenter" tag to all resources to track spending.

Azure Blueprints is a service for declarative, repeatable environment deployment. It acts as a package that bundles multiple artifacts—including ARM templates (for resource deployment), Role-Based Access Control (RBAC) assignments, and Policy assignments—into a single, versioned blueprint definition.

Microsoft Learn. (2024). Overview of Azure Policy. Azure Governance documentation. Retrieved November 6, 2025, from https://learn.microsoft.com/en-us/azure/governance/policy/overview.

Section: "What is Azure Policy?" and "Policy definition." This source confirms that Azure Policy "enforces different rules and effects over your resources" and provides built-in policy definitions like "Allowed virtual machine size SKUs," which directly matches the first requirement.

Microsoft Learn. (2024). Use tags to organize your Azure resources and management hierarchy. Azure Resource Manager documentation. Retrieved November 6, 2025, from https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources.

Section: "Introduction" and "Common use cases." This document states, "You apply tags to your Azure resources... to logically organize them... A common use case is to group resources by cost center." This directly supports the answer for the second requirement.

Microsoft Learn. (2024). Overview of Azure Blueprints. Azure Governance documentation. Retrieved November 6, 2025, from https://learn.microsoft.com/en-us/azure/governance/blueprints/overview.

Section: "What is Azure Blueprints?" and "What it does." This source explains that a blueprint is a "package for creating specific sets of standards" and allows the composition of artifacts such as "Resource Manager templates, Role-Based Access Control (RBAC) assignments, and Policy assignments." This matches the third requirement perfectly.