A security engineer is integrating Microsoft Defender for Cloud recommendations for Azure AI services into the organization's vulnerability management program. Defender for Cloud shows a high-severity recommendation: 'Azure AI services resources should have key access disabled (disable local authentication).' What is the security benefit of implementing this recommendation?

A is correct because the 'disable local authentication' (key access) recommendation in Defender for Cloud for Azure AI services requires all API authentication to use Microsoft Entra ID tokens instead of static API keys. This provides significant security benefits: Entra ID tokens can be protected by Conditional Access (device compliance, location, MFA), have short lifetimes with automatic refresh, are attributable to specific identities for auditing, and can be instantly revoked by disabling the user or managed identity, unlike static API keys which are long-lived shared secrets. B is incorrect because disabling key access does not affect the network-level communication of the AI service; it only changes the authentication method. C is incorrect because key rotation is a management practice for when keys are enabled; disabling keys eliminates the need for key rotation rather than automating it. D is incorrect because private endpoints are a network isolation control independent of the authentication method; disabling keys does not enforce private endpoint usage.