The security operations team receives a Microsoft Defender XDR alert indicating that an Azure OpenAI resource has been accessed using a token that originated from an IP address in a high-risk country. The team needs to contain the threat immediately. Which response action should be taken first?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to revoke the Microsoft Entra ID access token and disable the user or service principal that issued it. That cuts off the identity behind the compromised token right away, which is what containment requires.
Full Explanation
The correct response is to revoke the Microsoft Entra ID access token and disable the user or service principal that issued the token, because the alert describes access using a Microsoft Entra ID token rather than an Azure OpenAI API key. The containment action must invalidate the identity's ability to continue using that token. You can do this by disabling the affected user account or service principal, revoking refresh tokens with the 'Revoke sign-in sessions' command in Microsoft Entra ID, or using Microsoft Entra ID Protection to confirm the risk and force a sign-out. This immediately invalidates active or new tokens for that identity. The option to disable the Azure OpenAI API key associated with the compromised token is wrong because, if the resource is configured to use Microsoft Entra ID authentication rather than API keys, disabling an API key has no effect on an Entra-token-based attack. The option to enable Azure OpenAI content filtering on the compromised deployment is wrong because content filtering controls what the AI model can generate, not who can access the service, so it does not contain an active breach. The option to increase the Conditional Access policy MFA requirement to 'Every time' is wrong because it applies to future sign-in attempts and does not revoke the existing compromised token.