Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel →mediumMultiple SelectObjective-mapped
Integrating Microsoft Sentinel with Microsoft Defender XDR: Data Connector and Incident Creation
Which TWO of the following are valid ways to integrate Microsoft Sentinel with Microsoft Defender XDR?
Quick Answer
The answer is enabling automatic incident creation in the Microsoft Defender XDR connector and using the data connector itself to ingest alerts. The Microsoft Defender XDR data connector pulls in alerts and raw events from across the Microsoft 365 security stack, while the automatic incident creation toggle within that connector ensures those alerts are synthesized into actionable Sentinel incidents without manual intervention. On the AZ-500 exam, this tests your understanding of native integration versus automation: playbooks handle response, not ingestion, and cross-tenant setups require Azure Lighthouse, not the connector. A common trap is confusing the connector’s alert ingestion with incident creation—they are separate toggles. Remember the mnemonic “Data feeds, Incidents breeds” to recall that the connector brings in the data, and the incident creation switch turns those feeds into cases.
⚠ Common exam trap
Test-takers frequently confuse Azure Lighthouse (a cross-tenant management tool) with a data integration method, or think that any API-based polling (Option C) is a valid alternative to the native connector, when in fact only the official connector provides the required synchronization and automation features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Microsoft Defender XDR data connector
The Microsoft Defender XDR data connector is the official and supported method to ingest alerts and incidents from Microsoft Defender XDR into Microsoft Sentinel. This connector enables bi-directional synchronization, allowing incidents created in Defender XDR to appear in Sentinel and vice versa, with automatic correlation and enrichment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the Microsoft Defender XDR data connector
Why this is correct
The data connector ingests alerts and incidents.
- ✗
Use Azure Lighthouse to connect Defender XDR to Sentinel
Why it's wrong here
Azure Lighthouse is for managing multiple tenants.
- ✗
Deploy a playbook that polls Defender XDR APIs
Why it's wrong here
Playbooks are for response, not integration.
- ✓
Enable automatic incident creation in the Microsoft Defender XDR connector
Why this is correct
Automatic incident creation creates Sentinel incidents from Defender XDR alerts.
- ✗
Create a custom log analytics workspace query
Why it's wrong here
Custom queries do not integrate with Defender XDR.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE are prerequisites for integrating Microsoft Sentinel with Microsoft Defender XDR? (Choose three.)
hard- ✓ A.Appropriate permissions (Security Administrator or Global Administrator)
- ✓ B.The Microsoft 365 Defender data connector must be enabled in Sentinel
- C.The Microsoft Monitoring Agent installed on all endpoints
- ✓ D.A valid license for Microsoft 365 Defender (or individual workloads)
- E.An Azure Sentinel workspace in the same region as the Microsoft 365 tenant
Why A: Integrating Microsoft Sentinel with Microsoft Defender XDR requires the user to have either Security Administrator or Global Administrator roles in Azure Active Directory. These permissions are necessary to grant consent for the data connector and to configure cross-tenant or cross-service access policies that enable Defender XDR to send incident and alert data to Sentinel.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.