A compliance officer asks a security engineer about the Microsoft model for shared responsibility for AI security. The engineer needs to explain what security responsibilities remain with the customer when using Azure OpenAI as a PaaS service. Which of the following is a customer responsibility when using Azure OpenAI?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're responsible for customer-side controls: network access controls, API key or identity-based authentication, and application-layer content filtering and logging. Microsoft handles the hardware, data centers, and service uptime for Azure OpenAI.
Full Explanation
Configuring network access controls, managing API keys or identity-based authentication, and implementing application-layer content filtering and logging is correct because in the Azure PaaS shared responsibility model, Microsoft is responsible for the physical infrastructure, platform maintenance, and service availability, while customers are responsible for network access control configuration (private endpoints, firewall rules), authentication management (API keys versus managed identity), application-level security controls such as content filtering configuration, logging setup, and proper use of the service. Patching and maintaining the underlying GPU infrastructure running the AI models is incorrect because it is Microsoft's responsibility for the PaaS Azure OpenAI service. Managing the physical security of the Azure data centers hosting Azure OpenAI is incorrect because physical data center security is entirely Microsoft's responsibility in all cloud deployment models. Maintaining the availability and scalability of the Azure OpenAI service endpoints is incorrect because Azure OpenAI service endpoint availability (SLA) is Microsoft's responsibility; customer responsibility is designing resilient applications that handle service disruptions.