An organization wants to prevent Azure AI services (Cognitive Services) resources from being deployed outside of approved Azure regions. The governance policy should also prevent deploying AI resources without enabling private endpoints. Which Azure service enforces these requirements at scale?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Azure Policy can enforce organizational standards at scale through policy definitions with 'deny' effects. You can create policies that deny creation of Cognitive Services resources in non-approved regions and deny resources where public network access is enabled (i.e., where private endpoints are not configured).
Full explanation below image
Full Explanation
B is correct because Azure Policy can enforce organizational standards at scale through policy definitions with 'deny' effects. You can create policies that deny creation of Cognitive Services resources in non-approved regions and deny resources where public network access is enabled (i.e., where private endpoints are not configured). Policy initiatives can group multiple policies for AI governance. A is wrong because Defender for Cloud recommendations are advisory (audit-mode) and generate findings but do not prevent resource deployment. C is wrong because Azure Blueprints (deprecated in favor of Azure Deployment Environments and Template Specs) can assign policies but add a layer of complexity; Azure Policy alone is the direct mechanism for the enforcement. D is wrong because Microsoft Purview data governance manages data assets and classification, not Azure resource deployment enforcement.