In an Azure environment with resources distributed across multiple regions, which tool should be utilized to restrict administrators to creating resources only in designated regions?