A security team notices that Microsoft Defender for Cloud has raised an alert for 'Anomalous access to Azure OpenAI' for a service principal that normally calls the API with consistent token counts between 500-1,000 per hour but suddenly made 50,000 calls in one hour. The team needs to determine whether this is a legitimate batch job or an attack. Which initial investigation step uses Microsoft Security Copilot most effectively?

A is correct because Microsoft Security Copilot excels at multi-step investigation through natural language prompting. A single prompt asking Copilot to summarize the alert, retrieve the service principal's recent activity, surface any associated risk detections from Entra ID Protection, and check the source IP against threat intelligence leverages Copilot's ability to query multiple data sources (Defender for Cloud, Sentinel, Entra ID, MDTI) simultaneously and synthesize a coherent investigation summary—dramatically accelerating triage. B is wrong because manually searching the Azure portal is time-consuming, siloed to one data source, and misses the cross-platform correlation that Security Copilot provides. C is wrong because running PowerShell provides raw data but not the synthesized, correlated analysis that Security Copilot delivers for multi-source investigation. D is wrong because creating a Sentinel incident is a response action, not an investigation step; investigation should precede escalation.