A security engineer is designing the authentication architecture for a multi-tenant SaaS AI application built on Azure. Each customer tenant must be isolated and their AI interactions must not be visible to other tenants. Which Azure architecture pattern best achieves tenant isolation for the AI components?

C is correct because deploying separate Azure OpenAI resources per customer tenant with dedicated managed identities and separate Azure subscriptions or resource groups achieves the strongest isolation: each tenant's AI resource, authentication, and data are completely separate at the infrastructure layer, preventing any cross-tenant data access or configuration influence. A is incorrect because a shared Azure OpenAI resource with per-tenant API keys relies entirely on application-level isolation, which can be bypassed by bugs or compromises in the application layer. B is incorrect because while model deployments within an Azure OpenAI resource can have separate names, they share the same resource plane and data plane endpoint, making true tenant isolation difficult to achieve. D is incorrect because shared infrastructure with application-level data separation in Cosmos DB introduces cross-tenant risks if the application layer is compromised.