A company's security team wants to ensure that all Azure AI services in the organization's subscriptions have diagnostic settings configured to send logs to a central Log Analytics workspace. Which Azure tool enforces this requirement across all current and future AI service deployments?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need Azure Policy with a 'deployIfNotExists' effect because it can automatically create the missing diagnostic settings on Azure AI Services resources. That keeps logs flowing to your central Log Analytics workspace without you chasing every new deployment.
Full Explanation
Azure Policy with a 'deployIfNotExists' effect is correct because it automatically deploys a remediation action when a compliant resource is created or when existing resources lack the required configuration. It can detect when a new Cognitive Services (Azure AI Services) resource is created without diagnostic settings pointing to the central Log Analytics workspace and automatically configure the diagnostic settings, ensuring consistent log collection for all AI resources without manual intervention. Azure Advisor recommendations for enabling diagnostic settings are wrong because they are advisory and require manual action; they do not automatically enforce or remediate missing configurations. Microsoft Defender for Cloud recommendation to enable diagnostic logs is wrong because it also requires manual remediation; the 'Quick Fix' button can apply the fix but still requires a human to click it per resource. Azure Monitor workbook with a missing diagnostic settings report is wrong because it provides visibility and reporting, not automated enforcement or remediation of missing configurations.