A security team is designing the logging strategy for an AI application built on Azure OpenAI. The application processes sensitive legal documents. The team needs to balance security visibility (logging prompt content for forensics) against privacy (not logging PII in legal documents). What approach achieves this balance?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because disabling Azure OpenAI's native content logging (which stores raw prompts and completions in Microsoft systems) while implementing a custom logging proxy that applies PII redaction before persisting logs achieves the balance: security teams get visibility into AI interactions (for forensics and security monitoring) while sensitive PII in legal documents is masked before storage, addressing both privacy and compliance requirements. A is incorrect because enabling full content logging stores raw prompts containing PII in Azure Monitor logs, creating a compliance risk and additional sensitive data store; applying labels after the fact does not prevent PII exposure during log ingestion.
Full explanation below image
Full Explanation
B is correct because disabling Azure OpenAI's native content logging (which stores raw prompts and completions in Microsoft systems) while implementing a custom logging proxy that applies PII redaction before persisting logs achieves the balance: security teams get visibility into AI interactions (for forensics and security monitoring) while sensitive PII in legal documents is masked before storage, addressing both privacy and compliance requirements. A is incorrect because enabling full content logging stores raw prompts containing PII in Azure Monitor logs, creating a compliance risk and additional sensitive data store; applying labels after the fact does not prevent PII exposure during log ingestion. C is incorrect because metadata-only logging provides limited security forensic value without content context; a secondary AI model for summarization adds complexity and the secondary model itself would process PII. D is incorrect because logging only errors provides very limited forensic capability and Defender for AI alerts are triggered by specific threat patterns, not comprehensive audit coverage of all AI interactions.