Security needs notification when a supported risky administrative or user activity occurs. Which approach best fits?

1. Review and restrict the application's granted scopes using supported API controls.
2. Configure Marketplace application allowlisting and installation policy.
3. Create an appropriately scoped activity rule or alert.
4. Contain the account using appropriate session reset, credential, and token-revocation steps.