A security engineer needs to enforce that only identities within a specific Microsoft Entra ID tenant can access an Azure OpenAI resource. The organization wants to prevent cross-tenant token misuse. Which Azure OpenAI network and identity control should be implemented?

B is correct because requiring Entra authentication (disabling key-based auth) ensures that only authenticated Entra identities can call the API. Configuring Conditional Access scoped to the Azure OpenAI Service application restricts which tenant's identities and which conditions (compliant device, specific tenant) can obtain a token for the service, preventing cross-tenant token misuse. A is wrong because IP firewall rules block by network location, not by identity tenant—an attacker with a key and access from an allowed IP would still succeed. C is wrong because key-based auth is credential-based and does not enforce tenant identity; cross-tenant control requires identity-based authentication. D is wrong because Azure Front Door geo-filtering blocks by geography, not by Entra tenant identity.