A security engineer needs to implement continuous monitoring for configuration drift in Azure AI security controls. Specifically, the engineer needs to detect when Azure OpenAI resources have their public network access re-enabled after being configured as private-only. Which Azure service provides real-time drift detection and alerting?

B is correct because Azure Monitor activity log alerts can be configured to trigger on specific resource operations (Microsoft.CognitiveServices/accounts/write) with a condition matching when the publicNetworkAccess property is changed to Enabled. This provides near-real-time detection (within minutes) of configuration drift, alerting the security team immediately when the control is changed. A is incorrect because Defender for Cloud recommendations based on Azure Policy audit rules are evaluated periodically (not in real-time) and may take hours to reflect a change. C is incorrect because Sentinel scheduled analytics rules run on a defined interval (minimum 5 minutes) and would detect the change but with higher latency than an Azure Monitor activity log alert which fires on the event itself. D is incorrect because a deny effect Azure Policy prevents the change from occurring, which is the ideal preventive control; however, the question asks for drift detection and alerting, not prevention.