Question

A financial services company is deploying an Azure OpenAI Service instance to build an internal document-analysis assistant. The security architect must ensure that the service is not exposed to the public internet, that developer applications authenticate without long-lived API keys, and that all prompt and completion traffic stays on the corporate network. Which combination of controls should the architect specify?

Accepted Answer

Enable a private endpoint with Private Link, disable public network access, and require Microsoft Entra ID (managed identity) authentication with RBAC roles such as Cognitive Services OpenAI User

Answer

Restrict access with an IP-based firewall allowlist, rotate the account access keys every 30 days, and store the keys in Azure Key Vault

Answer

Place the service behind Azure Front Door with a WAF policy and enforce TLS 1.2, using shared key authentication scoped per application

Answer

Enable service endpoints on the application subnet, use a shared access signature (SAS) token per developer, and enable diagnostic logging to a Log Analytics workspace