Task 3.1: Implement security for AI

• ASwitch the backend from an API key to its managed identity for the calls

  Incorrect

  The calls would still come from the backend, so alerts would carry the application's identity, not the signed-in user's.

• BAdd UserSecurityContext, with user ID and source IP, to requests

  Correct

  Defender for Cloud uses these fields to put end-user context into AI alerts.

• CRoute the calls through the Azure AI model inference API, which forwards the caller's token

  Incorrect

  UserSecurityContext enrichment isn't supported for models consumed through that API.

• DAssign each user Foundry User on the resource so that alerts list their identities

  Incorrect

  Users don't call the model directly; the backend does, so their roles don't reach the alerts.

In application-mediated architectures, AI calls come from a web app or gateway, so alerts lack end-user context. Adding the optional UserSecurityContext object to Azure OpenAI chat completion requests, with at least EndUserId (the user's Entra object ID) and SourceIP, plus an application name, enriches Defender for AI services alerts. It isn't supported for models used through the Azure AI model inference API.

• ATarget the agent identity blueprint instead of the agent identity

  Incorrect

  Blueprint targeting is for app-only access by agents created from it, not delegated access.

• BCreate a user account for the agent and target that account

  Incorrect

  The agent acts as the signed-in employee, not as its own user account.

• CReplace the MFA grant with Block for the agent identity

  Incorrect

  A policy on the agent identity still wouldn't evaluate delegated requests.

• DTarget the users it acts for, with a policy on Exchange Online

  Correct

  In on-behalf-of access the user is the token subject, so user-targeted policies apply.

When an agent accesses resources on behalf of a signed-in user, the user is the token subject that Conditional Access evaluates, so policies assigned to that user or group apply; selecting the agent identity doesn't cover requests made on behalf of the user.

• ADelegate Restricted Content Discovery management to site administrators

  Correct

  Site administrators can then turn the setting on or off for their own sites, giving a justification that's audited with each change.

• BAssign the Finance site administrators the SharePoint Administrator role

  Incorrect

  That's the tenant-wide admin right the requirement rules out.

• CHave the site administrators turn off Allow this site to appear in Search results

  Incorrect

  That setting blocks the site's content in site-specific search as well, so Finance staff lose their own site search.

• DTurn on Restricted SharePoint Search and leave the Finance sites off its allow list

  Incorrect

  It's a tenant-level allow list that's retiring: new enablement has been blocked since July 31, 2026.

Restricted Content Discovery is a site-level setting that keeps a site's content out of organization-wide search and Copilot responses without changing permissions, and it doesn't affect searches that start from the site itself. By default only SharePoint administrators manage it; running Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true lets site administrators manage it for their own sites. A site administrator who changes the setting must give a justification, and the Purview audit log records the change and the justification.

• ADefender for Servers Plan 2

  Incorrect

  Server protection isn't one of the dashboard's requirements.

• BDefender CSPM with its sensitive data discovery extension

  Correct

  Sensitive data insights come from Defender CSPM's sensitive data discovery.

• CThreat protection for AI services

  Correct

  AI workload coverage and alerts need the AI services plan.

• DMicrosoft Purview Data Map scanning for sensitive data in the subscription

  Incorrect

  The dashboard relies on Defender plans, not a Purview Data Map scan.

• EDefender for Key Vault threat protection

  Incorrect

  Key Vault protection isn't required for the dashboard.

For full access to the Data and AI security dashboard, enable Defender CSPM and its sensitive data discovery extension, Defender for Storage, Defender for Databases and threat protection for AI workloads, and register the subscription to the Microsoft.Security resource provider. The dashboard shows which data and AI resources are fully, partially or not protected.

• AGlobal Administrator

  Incorrect

  It can approve requests, but it's far more privileged than needed.

• BGlobal Reader

  Incorrect

  Readers can monitor governance gaps but can't take administrative action.

• CAI Administrator

  Correct

  Governance actions such as approving agent requests or assigning ownership need AI Administrator or Global Administrator.

• DSecurity Reader

  Incorrect

  Security Reader can open risk signal links but can't approve agents.

In the Microsoft 365 admin center, agent submissions are reviewed in the Agent Registry before they're published to the store. Governance actions such as approving agent requests or assigning ownership can be performed only by users in the AI Administrator or Global Administrator roles; other roles can monitor gaps. Microsoft recommends the least-privileged role.

• AYes, to OneDrive and SharePoint sites alike

  Incorrect

  It's not supported for OneDrive.

• BOnly to OneDrive sites of departed users

  Incorrect

  There's no OneDrive variant.

• COnly when restricted access control is also applied

  Incorrect

  The two features are independent, and neither makes it work on OneDrive.

• DNo, it applies only to SharePoint sites

  Correct

  You can only apply this feature to SharePoint sites.

Restricted Content Discovery can only be applied to SharePoint sites; it's not supported for OneDrive sites. It also doesn't affect searches that start from site context.

• AOnly Microsoft Entra ID Free

  Incorrect

  Conditional Access for agents needs more than the free tier.

• BMicrosoft Entra Workload ID Premium, which covers agents

  Incorrect

  Agents use Agent 365 licensing for this.

• CMicrosoft 365 E3 alone

  Incorrect

  E3 must be paired with an Agent 365 license.

• DMicrosoft 365 E7, or Microsoft Agent 365 with at least Microsoft Entra P1 or Microsoft 365 E3

  Correct

  These are the documented license options.

Microsoft Entra Conditional Access for agents requires Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite, or a Microsoft Agent 365 license paired with at least Microsoft Entra P1 or Microsoft 365 E3.

• AThe last 28 days

  Correct

  Activity reports track potential oversharing in the last 28 days.

• BThe last 7 days

  Incorrect

  They cover a longer period.

• CThe last 180 days

  Incorrect

  That's the period for change history reports.

• DEverything since the site was created

  Incorrect

  That describes a snapshot of current state, not activity.

Data access governance activity reports, such as sharing links and Shared with Everyone except external users, track potential oversharing that occurred in the last 28 days. Snapshot reports show current state as of when they're generated.

• AA 90-day trial with no limit

  Incorrect

  The trial is shorter and capped.

• BNo trial; billing starts at once

  Incorrect

  The plan includes a trial.

• C30 days, capped at 75 billion tokens scanned

  Correct

  Billing begins if the cap is reached within the 30 days.

• DOne million tokens a month, forever

  Incorrect

  There's no permanent free allowance in the plan.

Defender for AI Services includes a 30-day free trial capped at 75 billion tokens scanned. If the cap is reached within the 30 days, billing begins.