A security team discovers that an Azure OpenAI deployment is experiencing a credential stuffing attack where attackers cycle through many API keys attempting to find valid ones. Which combination of controls in Azure API Management (APIM) and Microsoft Entra ID provides the most comprehensive protection?

B is correct because credential stuffing targets the API key authentication model. Migrating to Entra ID OAuth 2.0 tokens eliminates the static API key attack surface entirely. Enforcing this via APIM validate-jwt policy ensures only valid Entra ID tokens are accepted, and Conditional Access requiring compliant devices adds another verification layer making credential stuffing impractical since attackers would also need valid device compliance. A is incorrect because IP filtering helps but does not address the core issue of API key authentication being vulnerable; key rotation is reactive, not preventive. C is incorrect because rate limiting slows credential stuffing but does not prevent it; it remains vulnerable to distributed, low-volume attacks. D is incorrect because DDoS Protection and caching address availability and performance concerns, not authentication credential stuffing.