Secure compute

Three requirements can sound nearly identical and still be answered by three different services: stop an unauthenticated caller reaching a web API, stop an administrator reaching a virtual machine over the public internet, and stop Microsoft 365 Copilot surfacing a document the person asking should never have been able to open. What separates them is the layer the workload runs on, and this domain is organized by exactly that. AI workloads are the Copilot, agent, and model layer that sits above the other two, where an agent is a Copilot Studio or Foundry agent, not software installed on a machine. Servers and virtual machines are the machines whose operating system you own, whether an Azure virtual machine or a datacenter or other-cloud server projected into Azure by Azure Arc. Application platform services are the managed hosts that run application code for you, from containers and functions to web apps, with a web application firewall or Azure API Management in front. Each page then names the control points that secure its layer, a control point being one place where a decision about the workload is made and configured (the application platform page calls its five control families). No control point switches another on: encrypting a disk closes no management port, and giving a workload a managed identity, an identity whose credentials Azure manages, leaves its public endpoint answering.

Read them in order. Implement security for AI covers the topmost layer through four control points: data reach (which data Microsoft 365 Copilot and agents can already reach), agent identity (through Microsoft Entra Agent ID), runtime inspection (what a model or agent actually does), and evidence (what makes a later investigation possible). Implement security for servers and virtual machines (VMs) drops to the machine itself: disk encryption, boot integrity, administrative reach (how an administrator gets an interactive session), guest configuration, and workload protection (what detects and responds on the machine). One scope question runs underneath that page, whether the machine is an Azure virtual machine or an Arc-enabled server, because it decides which of those controls Azure can apply at all. Implement security for application platform services covers code you host without owning a machine, through five control families: network reach (which sources can reach the endpoint), request enforcement (what the platform decides about a request before your code runs), workload identity (how running code authenticates to Azure without a stored secret), admission control (which images and workload specifications are admitted), and posture and runtime detection (what assesses and watches what is already running). The mechanisms, service-by-service comparisons, and traps live on those pages; this one only says which page owns a question.

The wrong option in this domain is usually a control that is switched on but not doing the job the scenario asks for. A private endpoint on an App Service app gives it a private address and leaves its public endpoint answering until public network access is disabled as a separate step. An Azure Arc connection makes a non-Azure server manageable from Azure and is not evidence that Defender for Endpoint onboarded it, and a Defender for Servers plan buys capability that several of its features still require you to turn on. A machine configuration assignment in Audit mode reports a non-compliant guest setting indefinitely and never corrects it, the built-in Copilot Studio protection rule records agent behavior without stopping anything, and a web application firewall policy in detection mode logs rule matches without blocking the request. The instinct worth carrying into every question here: name the control that sits in the path of the thing being stopped, then check that its mode enforces rather than reports.