A security engineer is configuring Microsoft Defender for Cloud to protect an Azure OpenAI resource. They want to receive alerts when the OpenAI endpoint is accessed from a Tor exit node or anonymous proxy. Which Microsoft Defender plan must be enabled?

Microsoft Defender for AI (preview) is correct because it provides threat protection specifically for Azure AI services, including Azure OpenAI, and generates alerts for suspicious access patterns such as connections from anonymizing networks like Tor or anonymous proxies. The Microsoft Defender for App Service plan is incorrect because it protects web applications hosted on App Service, not Azure AI services. The Microsoft Defender for Key Vault plan is incorrect because it monitors for suspicious Key Vault access, not AI endpoint access. The Microsoft Defender for DNS plan is incorrect because it monitors DNS query anomalies, not AI service access patterns.