Northwind Traders operates in the European Union and is deploying a Dynamics 365 Copilot feature. The data residency compliance team wants to validate that customer data processed by AI features does not leave the EU data boundary. Which TWO actions should the architect take to validate data residency compliance?
- A. Configure a Conditional Access policy in Microsoft Entra ID that blocks sign-ins from non-EU IP addresses
- B. Enable Azure DDoS Protection Standard on the tenant's virtual networks to prevent data from being routed outside the EU
- C. Review the Microsoft Product Terms and the Data Protection Addendum (DPA) to verify that the specific Copilot feature's data processing commitments cover EU data residency for the tenant's subscription✓ Correct
- D. Apply an Azure Policy that denies resource deployment outside of West Europe and North Europe regions across the entire Azure subscription
- E. Confirm that the Power Platform environment is provisioned in an EU-region geography and that the 'Move data across regions' setting is disabled in the Power Platform admin center for that environment✓ Correct
Explanation
Provisioning the environment in an EU geography and disabling cross-region data movement is the platform-level control that keeps data processing within the EU boundary for Power Platform and Dataverse workloads. Reviewing the Microsoft Product Terms and DPA validates Microsoft's contractual commitments for the specific Copilot feature — essential for compliance assurance when data is processed by Microsoft-hosted AI services. Azure Policy on Azure regions governs IaaS/PaaS resource deployment and does not control where Power Platform or Dynamics 365 SaaS features process data. DDoS Protection Standard protects against volumetric network attacks and has no effect on data residency. Conditional Access IP-based policies restrict which users can authenticate — they do not control where Microsoft's backend services process AI workloads.