Identifies the first occurrence within the last seven days of a high-privilege Azure principal performing sensitive credential-related actions on Microsoft Foundry (Azure AI Services): listing API keys, regenerating API keys for a Foundry account, or reading stored secrets for a Foundry account or project connection. Foundry keys grant inference access to all model deployments on the account and can bypass Entra ID conditional access, enabling potential LLMjacking or pivoting to connected data. The rule triggers on privileged roles (e.g., Owner, Contributor, Cognitive Services Contributor, User Access Administrator) when a successful action is logged by Azure Activity Logs (azure.activitylogs) for the relevant Foundry resources. It focuses on the first such event in a seven-day window to reduce noise and enable rapid investigation of potentially unauthorized access, with triage guidance to confirm caller identity, resource scope, and sign-in context, and remediation steps if unauthorized access is detected.