Azure Governance for OpenAI Agents: Policy vs. Defender
HOTSPOT
A company deploys agents that generate responses by using Azure OpenAI resources. The agents are deployed to both the United States and Europe.
You need to recommend a governance solution that meets the following requirements:
Enforces the deployment of the resources to only approved Azure regions
Provides continuous compliance verification of the resources
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Community Insight
The question tests the distinction between preventive governance (enforcing rules at deployment) and continuous security posture management, a common trap where candidates confuse data governance with infrastructure compliance.
This scenario addresses the selection of Azure governance tools to enforce regional deployment restrictions and provide continuous compliance verification for AI resources. The page establishes that Azure Policy is used for enforcement while Microsoft Defender for Cloud handles continuous monitoring.
Candidates often select Microsoft Purview for both requirements because it is a well-known governance tool, or they mistakenly believe Azure Policy alone provides continuous real-time security monitoring and posture assessment.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To restrict deployments to approved regions, you must use Azure Policy. Specifically, the built-in 'Allowed locations' policy definition can be assigned to the subscription or resource group to deny any deployment outside the specified US and EU regions. For the second requirement, Microsoft Defender for Cloud is the correct choice because it provides continuous compliance verification and security posture management for cloud resources, including Azure OpenAI services. It continuously monitors configurations against security standards.Why Other Candidate Answers Are Wrong
Microsoft Purview is primarily a data governance, risk, and compliance service focused on data discovery and classification. While it has some compliance features, it does not actively prevent resource creation in unauthorized regions nor does it provide the continuous infrastructure security monitoring required here. Azure Policy alone (without Defender) evaluates compliance periodically but does not offer the advanced continuous security posture management and threat detection capabilities associated with 'continuous compliance verification' in the context of modern cloud security operations.Community Comment Notes
Community consensus correctly identifies Azure Policy for region restriction. Several users initially debated between Defender for Cloud and Microsoft Purview for the second slot. As user janesb noted, "Purview is a data governance / compliance tool, but the requirement here is continuous compliance verification of Azure resources," confirming that Defender is the appropriate infrastructure security tool. User omath also highlighted that Defender provides continuous compliance assessment, reinforcing this distinction.Official Reference
Exam Strategy
Always distinguish between 'preventing' bad actions (Policy) and 'monitoring' security posture (Defender). When a requirement mentions 'continuous compliance verification' or 'security posture' for cloud resources, think Microsoft Defender for Cloud first, especially when paired with a prevention requirement.
Frequently Asked Questions
What is the difference between Azure Policy and Microsoft Defender for Cloud?
Azure Policy enforces organizational standards and scope at deployment time (preventive). Microsoft Defender for Cloud continuously monitors and assesses security posture and compliance after deployment (detective/corrective).
Can Microsoft Purview replace Azure Policy for region restrictions?
No. Microsoft Purview is for data governance and classification. Azure Policy is the native tool for controlling resource creation parameters like location, type, and tags.