A Sentinel playbook is triggered when a high-severity Azure OpenAI abuse incident is created. The playbook must automatically disable the Azure OpenAI deployment that is being abused to stop ongoing data exfiltration. Which Logic Apps action accomplishes this containment?

B is correct because Logic Apps includes an Azure Resource Manager connector that can make authenticated management API calls. To disable (rather than delete) an Azure OpenAI model deployment, the playbook can call the Azure OpenAI management API through the ARM connector to update the deployment's capacity to zero or change its status, effectively stopping inference without permanently removing the deployment configuration. This containment action can be reversed once the incident is resolved. A is wrong because deleting a model deployment is destructive and may not be recoverable; disabling is the preferred containment action that preserves the configuration for later restoration. C is wrong because updating network firewall rules blocks all clients including legitimate ones, but does not stop the specific deployment from being abused if the attacker already has a valid token; also, this is a less precise containment action. D is wrong because revoking service principal tokens is appropriate when the attack involves a compromised identity, but if the abuse uses API keys or a different access method, token revocation does not stop it.