An organization wants to implement a proactive security control for their Azure OpenAI deployment that automatically blocks known malicious IP addresses identified by Microsoft threat intelligence. Which Azure native service enforces this at the network level?

The correct choice is Azure Firewall Premium with the Microsoft Managed Threat Intelligence IDPS ruleset enabled because it includes a Microsoft Managed Threat Intelligence-based intrusion detection and prevention system ruleset that automatically blocks known malicious IP addresses, domains, and URLs identified by Microsoft's threat intelligence. This provides automatic, continuously updated protection without requiring manual IP list management. The Azure OpenAI network access rules option with IP range restrictions updated daily from Microsoft threat intel feeds is incorrect because Azure OpenAI network access rules, also called the service firewall, require manual IP range specification and do not integrate with live threat intelligence feeds for automatic blocking. The Azure DDoS Protection Standard option with custom mitigation policies for Azure OpenAI endpoints is incorrect because Azure DDoS Protection Standard focuses on volumetric DDoS attacks and does not specifically block individual known malicious IPs based on threat intelligence. The Network Security Group option with inbound deny rules populated from the Microsoft threat intelligence IP list is incorrect because NSG rules with manual threat intelligence IP lists require custom automation to keep the rules updated and do not provide the automatic, real-time blocking that Azure Firewall Premium's managed threat intelligence ruleset provides.