An allowed-locations policy with a deny effect is assigned to a subscription. A deployment requests a non-exempt resource in a prohibited region. What is the expected result?

1. Contributor users can always ignore the policy
2. The resource deploys and only a budget email is sent
3. The resource automatically moves to an approved region
4. The noncompliant deployment is denied