Restrict tenants to in-place restores by creating a custom role and then assigning the role and users to specific virtual machines. The custom role prevents tenants from indirectly creating new virtual machines by restoring to a new location (out-of-place restores), which might result in additional service charges.