An organization uses Azure OpenAI Service and wants to ensure that only specific service principals can call the Azure OpenAI API. The developer team should be blocked from accessing the API key directly. Which combination of controls achieves this?

A is correct because Azure OpenAI Service supports disabling key-based authentication at the resource level (setting 'disable local authentication' to true), forcing all callers to use Microsoft Entra ID tokens. Assigning the 'Cognitive Services OpenAI User' role to only approved service principals ensures least-privilege token-based access. B is wrong because rotating API keys and using Key Vault still allows key-based access; it does not block developers from using keys if they have Key Vault access. C is wrong because Conditional Access does not apply to API calls made by service principals, only to interactive user sign-ins. D is wrong because the Cognitive Services Contributor role is an administrative role that grants management plane access, not just API inference access.