Your company wants to enforce that no virtual network in any subscription can have a peering connection to an unauthorized VNet. Which Azure service enforces this?

Remaining questions and full explanations are VIP-exclusive.