A Sentinel playbook is triggered when a high-severity Azure OpenAI abuse incident is created. The playbook must automatically disable the Azure OpenAI deployment that is being abused to stop ongoing data exfiltration. Which Logic Apps action accomplishes this containment?

The Azure Resource Manager connector action that updates the Azure OpenAI deployment status to disabled is correct because Logic Apps includes an Azure Resource Manager connector that can make authenticated management API calls. To disable rather than delete an Azure OpenAI model deployment, the playbook can call the Azure OpenAI management API through the Azure Resource Manager connector to update the deployment's capacity to zero or change its status, effectively stopping inference without permanently removing the deployment configuration. This containment action can be reversed once the incident is resolved. The REST API action that deletes the model deployment is wrong because deleting a model deployment is destructive and may not be recoverable; disabling is the preferred containment action that preserves the configuration for later restoration. The network firewall rule update that blocks all IPs is wrong because updating network firewall rules blocks all clients including legitimate ones, but does not stop the specific deployment from being abused if the attacker already has a valid token; also, this is a less precise containment action. The Microsoft Graph API action that revokes the service principal's tokens is wrong because revoking service principal tokens is appropriate when the attack involves a compromised identity, but if the abuse uses API keys or a different access method, token revocation does not stop it.