An organization's security team has identified a pattern where threat actors are using compromised developer credentials to enumerate Azure OpenAI model deployments and extract prompt configurations. Which Microsoft Sentinel data connector and analytic approach best detects this reconnaissance activity?

A is correct because enumerating Azure OpenAI deployments is a control plane operation recorded in Azure Activity logs (management plane API calls). These include ListDeployments calls to the Azure OpenAI management API. By connecting Azure Activity logs to Sentinel and writing an analytics rule that flags frequent ListDeployments operations from unusual IP addresses or locations compared to a baseline, the team can detect reconnaissance of AI model configurations. B is wrong because Defender for Endpoint monitors endpoint telemetry; enumeration of Azure OpenAI management APIs is a cloud control plane activity, not endpoint activity. C is wrong because failed MFA attempts indicate authentication attacks, not post-authentication API enumeration. D is wrong because M365 Defender monitors Microsoft 365 workloads; enumeration of Azure OpenAI management endpoints is captured in Azure Activity logs, not M365 telemetry.