A security engineer is reviewing Microsoft Entra ID sign-in logs for an AI pipeline service account. The logs show sign-ins using 'Seamless Single Sign-On' from an IP address in an unexpected country. The service account is supposed to run only in Azure datacenters. What is the most appropriate immediate action?

A is correct because Seamless SSO sign-ins use Kerberos tickets issued by on-premises Active Directory and the AZUREADSSOACC computer account. A Seamless SSO sign-in from an unexpected international location for a service account that should only authenticate from Azure datacenters indicates potential on-premises AD compromise or Kerberos ticket forgery. The immediate action is to reset the AZUREADSSOACC password (to invalidate any forged tickets) and investigate the on-premises domain for signs of compromise. B is incorrect because blocking the service account stops current harm but creating a new account without understanding the root cause (on-premises compromise) leaves the attacker able to compromise the new account through the same vector. C is incorrect because adding the unexpected IP to named locations would dismiss a genuine threat indicator; the sign-in pattern is anomalous for a datacenter-only service account. D is incorrect because a 24-hour monitoring period before action gives an attacker significant time to continue unauthorized activities.