The security operations team receives a Microsoft Defender XDR alert indicating that an Azure OpenAI resource has been accessed using a token that originated from an IP address in a high-risk country. The team needs to contain the threat immediately. Which response action should be taken first?

B is correct because the threat uses a Microsoft Entra ID token (not an API key), so the containment action is to revoke the token. Tokens can be revoked by disabling the user account or service principal, revoking refresh tokens using the 'Revoke sign-in sessions' command in Entra ID, or using Entra ID Protection to confirm the risk and force a sign-out. This immediately invalidates any active or new tokens for that identity. A is wrong because if the resource is configured to use Entra ID authentication (not API keys), disabling an API key has no effect on the Entra-token-based attack. C is wrong because content filtering controls what the AI model can generate, not who can access the service; it does not contain an active breach. D is wrong because increasing MFA requirements in Conditional Access applies to future sign-in attempts; it does not revoke the existing compromised token.