Azure Governance for OpenAI Agents: Policy vs. Defender
Short answer
For enforcing deployment to approved regions, include Azure Policy. For providing continuous compliance verification of the resources, include Microsoft Defender for Cloud.
Question
A company deploys agents that generate responses by using Azure OpenAI resources. The agents are deployed to both the United States and Europe.
You need to recommend a governance solution that meets the following requirements:
Enforces the deployment of the resources to only approved Azure regions
Provides continuous compliance verification of the resources
What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The question tests the distinction between preventive governance (enforcing rules at deployment) and continuous security posture management, a common trap where candidates confuse data governance with infrastructure compliance.
This scenario addresses the selection of Azure governance tools to enforce regional deployment restrictions and provide continuous compliance verification for AI resources. The page establishes that Azure Policy is used for enforcement while Microsoft Defender for Cloud handles continuous monitoring.
Common mistake: Candidates often select Microsoft Purview for both requirements because it is a well-known governance tool, or they mistakenly believe Azure Policy alone provides continuous real-time security monitoring and posture assessment.
Expert Analysis
Why the Answer Is Correct
To restrict deployments to approved regions, you must use Azure Policy. Specifically, the built-in 'Allowed locations' policy definition can be assigned to the subscription or resource group to deny any deployment outside the specified US and EU regions. For the second requirement, Microsoft Defender for Cloud is the correct choice because it provides continuous compliance verification and security posture management for cloud resources, including Azure OpenAI services. It continuously monitors configurations against security standards.
Why Other Candidate Answers Are Wrong
Microsoft Purview is primarily a data governance, risk, and compliance service focused on data discovery and classification. While it has some compliance features, it does not actively prevent resource creation in unauthorized regions nor does it provide the continuous infrastructure security monitoring required here. Azure Policy alone (without Defender) evaluates compliance periodically but does not offer the advanced continuous security posture management and threat detection capabilities associated with 'continuous compliance verification' in the context of modern cloud security operations.
Community Comment Notes
Community consensus correctly identifies Azure Policy for region restriction. Several users initially debated between Defender for Cloud and Microsoft Purview for the second slot. As user janesb noted, "Purview is a data governance / compliance tool, but the requirement here is continuous compliance verification of Azure resources," confirming that Defender is the appropriate infrastructure security tool. User omath also highlighted that Defender provides continuous compliance assessment, reinforcing this distinction.
Exam Strategy
Always distinguish between 'preventing' bad actions (Policy) and 'monitoring' security posture (Defender). When a requirement mentions 'continuous compliance verification' or 'security posture' for cloud resources, think Microsoft Defender for Cloud first, especially when paired with a prevention requirement.
Frequently Asked Questions
What is the difference between Azure Policy and Microsoft Defender for Cloud?
Can Microsoft Purview replace Azure Policy for region restrictions?
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
janesb 👍 131st part of the question is correct Azure policy , but for the 2nd part it should be Defender , not Purview. Purview is a data governance / compliance tool, but the requirement here is continuous compliance verification of Azure resources (Azure OpenAI accounts, storage, networking, logging, encryption settings, public access, etc.)
-
omath 👍 81. Azure Policy → Restrict deployments to approved regions Azure Policy can enforce rules such as: - “Resources may only be deployed in East US and West Europe” - “Deny creation of resources outside approved regions” This is the only tool designed for preventive governance. 2. Microsoft Defender for Cloud → Continuous compliance verification Defender for Cloud provides: - Continuous compliance assessments - Regulatory standards mapping (ISO, SOC, GDPR, etc.) - Secure score - Alerts when resources drift out of compliance This satisfies the requirement for ongoing compliance monitoring.
-
rveney 👍 6Enforces the deployment of the resources to only approved Azure regions: ➡️ Azure Policy Use built-in or custom Azure Policy definitions such as “Allowed locations” to deny deployments outside approved US and EU regions. Provides continuous compliance verification of the resources: ➡️ Microsoft Defender for Cloud Defender for Cloud provides continuous security posture and compliance monitoring, including compliance dashboards and ongoing assessment against standards (it leverages policy evaluations and surfaces compliance status continuously).
-
Newb007 👍 3I'm about 90% sure it's Azure Policy for both
-
Joselito79 👍 1. Approved regions → Azure Policy Azure Policy has a built-in Allowed locations policy that can restrict resource deployments to specified Azure regions. With a Deny effect, deployments outside the approved regions are blocked. 2. Continuous compliance → Azure Policy Azure Policy evaluates resources for compliance when they're created/updated and through the ongoing compliance evaluation cycle (normally every 24 hours). It provides a compliance dashboard showing compliant/non-compliant resources
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.