An SAP landing zone must prevent new resources in unapproved regions. Which control addresses this requirement?

1. An appropriately scoped Azure Policy allowed-locations rule
2. A resource tag without enforcement
3. A VM backup schedule
4. A budget alert alone