Question

A financial services organization is building a generative AI application that uses Azure OpenAI grounded on data stored in a Microsoft Fabric lakehouse and Azure Data Lake Storage Gen2. Before the data can be used for AI grounding, the security architect must ensure that regulated data (PII, account numbers) is discovered and classified across these repositories, and that the classification results can drive downstream protection and governance decisions for the AI workload. Which solution should the architect recommend to meet the discovery and classification requirement with the least custom development?

Accepted Answer

Deploy Microsoft Purview Data Map with scans configured against the Azure Data Lake and Fabric sources, using built-in and custom classifiers to automatically discover and classify sensitive data assets

Answer

Enable Microsoft Defender for Storage on the Data Lake account and rely on its malware scanning alerts to identify files containing sensitive data

Answer

Configure Azure Policy definitions that deny storage of unclassified blobs and require developers to tag each dataset manually before AI grounding

Answer

Apply Purview sensitivity labels with encryption to every file in the lakehouse and let the labels serve as the discovery mechanism