A security engineer needs to configure Microsoft Sentinel to detect when an Azure Machine Learning model training job accesses data outside its approved dataset scope. The engineer wants to detect when the training job service principal reads data from a storage account container not in the approved list. Which data source in Sentinel captures this activity?

B is correct because Azure Storage resource logs (StorageBlobLogs) capture detailed data plane operations including read operations on specific containers, along with the identity that performed the operation. By filtering for read operations by the training job's service principal or managed identity on containers not in the approved list, a Sentinel analytics rule can detect unauthorized data access during training. A is incorrect because AzureActivity captures control plane operations (creating training jobs, stopping clusters) not data plane storage access operations. C is incorrect because AmlComputeClusterEvent logs capture compute cluster lifecycle events (scaling, node allocation), not the data operations performed during training jobs. D is incorrect because MicrosoftGraphActivityLogs capture Microsoft Graph API calls, not Azure Storage data access operations.