A security analyst is using Microsoft Sentinel's User and Entity Behavior Analytics (UEBA) to investigate an Azure AI service account that has been flagged as having anomalous activity. The UEBA engine has raised an 'Anomalous Azure resource access' insight for this service principal. Where in Sentinel can the analyst see the full UEBA profile for this entity including timeline, peer comparison, and risk score?

B is correct because Microsoft Sentinel's UEBA engine populates entity pages for users, devices, and service principals. The entity behavior page for the service principal shows the UEBA risk score, a timeline of activities, anomalous insights detected by the ML engine (like the anomalous Azure resource access), peer comparison data showing how this entity's behavior differs from similar service principals, and a list of related incidents. This provides the analyst with a holistic view of the entity's behavioral risk. A is wrong because while the BehaviorAnalytics table in KQL contains the raw UEBA data, querying it directly does not provide the visual entity page with timeline and peer comparison that the question asks about. C is wrong because Entra ID Identity Protection > Risky workload identities shows identity risk detections for service principals based on Entra-specific signals, not the full Sentinel UEBA profile with Azure resource activity. D is wrong because Defender XDR entity timeline shows endpoint and identity-related activities within Defender's scope, not the full Sentinel UEBA profile.