A security engineer is configuring Azure Content Safety for a customer-facing AI application. The application serves users in multiple regions and must comply with regional content regulations. The engineer needs to configure content filtering thresholds that are stricter for the EU region compared to the US region. How should this be implemented?

The correct approach is to create two separate Azure OpenAI deployments with different content filtering configurations and route EU users to the stricter deployment. Azure OpenAI supports multiple model deployments within a single resource, each with its own content filter policy. By creating two deployments with different content filter configurations, such as stricter thresholds for EU compliance, and routing EU users to the EU-configured deployment via application-layer logic or Azure API Management geo-routing, the organization achieves region-specific content filtering without separate infrastructure for each region. The single Azure OpenAI content filter policy with region-based conditions referencing the caller's IP geolocation is incorrect because Azure OpenAI content filter policies cannot include dynamic conditions based on caller IP geolocation; they are static severity threshold configurations applied to entire deployments. The Azure API Management with geo-based routing that applies different Azure API Management content transformation policies per region is incorrect because Azure API Management content transformation policies can modify request/response headers but cannot apply the underlying AI content safety filtering thresholds, which are configured at the Azure OpenAI deployment level. The Azure Traffic Manager routing EU users to a separately deployed Azure AI Content Safety instance with stricter thresholds is incorrect because Azure AI Content Safety and Azure OpenAI are separate services; Traffic Manager routing to different Content Safety instances would not change the Azure OpenAI deployment's content filtering configuration.