Exam AB-100 Topic 1 Question 91 Discussion

Explanation:
Box 1: Azure Policy
Enforces the deployment of the resources to only approved Azure regions To enforce the deployment of Azure OpenAI resources to only approved Azure regions (e.g., specific regions in Europe and the USA), you should use Azure Policy with the "Allowed locations" policy definition.
Here is the breakdown of how to implement this control:
Primary Tool: Azure Policy
Azure Policy allows you to define rules that restrict where resources can be created.
Policy Rule: Use the Allowed locations policy definition.
Implementation: Assign this policy at the Subscription or Resource Group level to restrict developers to only using permitted regions (e.g., East US, West Europe).
Effect: If a user attempts to deploy an Azure OpenAI resource in a non-approved region, the deployment will be blocked.
Box 2: Microsoft Purview
Provides continuous compliance verification of the resources
To provide continuous compliance verification for Azure OpenAI resources across Europe and the USA, you should use Microsoft Purview Compliance Manager and Azure Policy.
Microsoft Purview Compliance Manager: This tool provides a risk-based compliance score and continuous monitoring against global regulations such as the EU AI Act, GDPR, and various US standards. It offers specific regulatory templates to help you assess and implement controls for generative AI applications.
Azure Policy: Use this to enforce organizational standards and assess compliance at scale. You can apply built-in policy definitions for Azure AI services to automatically audit or deny non- compliant resource configurations, such as ensuring resources are restricted to specific regions (e.g., only EU or USA) or have private network access enabled.
Reference:
https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/deployment-types
https://learn.microsoft.com/en-us/purview/ai-agent-365