A security engineer is hardening an Azure OpenAI resource and wants to ensure that if someone gains access to the Azure portal and attempts to delete the resource, they cannot do so without additional approval. Which Azure feature prevents accidental or unauthorized deletion?

B is correct because Azure Resource Locks can be applied at the resource, resource group, or subscription level. A 'CanNotDelete' lock prevents any user—including resource owners and subscription administrators—from deleting the locked resource without first removing the lock. This protects the Azure OpenAI resource from accidental or unauthorized deletion, as removing a lock is an additional privileged action. A is wrong because Azure Policy with a Deny effect can prevent resource creation or configuration changes, but cannot block DELETE operations on existing resources (Policy applies to PUT and PATCH operations by default). C is wrong because Defender for Resource Manager generates alerts for suspicious management operations but does not prevent delete operations in real time. D is wrong because PIM controls role activation and limits who can have the Contributor role, but does not add an approval step specifically for delete operations once the role is active.