MD-102 Protect devices Practice Question
Your organization uses Microsoft Defender for Cloud Apps (part of Microsoft Defender XDR). You need to detect when users access cloud apps from unauthorized locations. Which log source should you integrate to get location information?
⚠ Common exam trap
MD-102 often tests the confusion between different log sources; candidates may choose Microsoft Sentinel or Purview audit logs, but the specific location data for cloud app access comes from Entra ID sign-in logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID sign-in logs
Microsoft Entra ID sign-in logs contain location information (IP address, country, city) for user sign-ins to cloud apps. Integrating these logs with Defender for Cloud Apps enables detection of access from unauthorized locations. Other log sources do not provide the necessary location context for cloud app access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID sign-in logs
Why this is correct
Microsoft Entra ID sign-in logs record each authentication with the originating IP address, which Defender for Cloud Apps resolves into country, city and coordinates for its impossible travel and anomalous location detections. This directly satisfies the requirement to identify access from unauthorised locations, since the sign-in event carries the geo-location data the policy evaluates.
- ✗
Microsoft Intune device enrollment logs
Why it's wrong here
Intune enrollment logs capture device registration events and hardware attributes, containing no user cloud-app access location data for Defender for Cloud Apps to evaluate. It is tempting because Intune manages device compliance, but that fits conditional access device-state decisions, not detecting sign-ins from unauthorised geographic locations.
- ✗
Microsoft Purview audit logs
Why it's wrong here
Purview audit logs record user and admin activity within Microsoft 365 services, not the source IP geolocation that Defender for Cloud Apps correlates for impossible-travel and unauthorised-location alerts. It is tempting because Purview holds rich activity data, but that suits compliance investigation and eDiscovery, not Cloud Apps location detection.
- ✗
Microsoft Sentinel
Why it's wrong here
Sentinel is a SIEM/SOAR platform that ingests and correlates logs; it does not supply the location telemetry Defender for Cloud Apps needs for its own anomaly detection. It is tempting because Sentinel can forward enriched data, but that is for centralised hunting and incident correlation, not for feeding Cloud App Discovery location context.
Go deeper
Related to this question
Learn chapter
Enrolling Devices with Microsoft Intune
Key term
Microsoft Defender XDR
Microsoft Defender XDR is a unified security platform that automatically correlates alerts from across an organization's endpoints, email, identities, and cloud apps to stop complex attacks.
Key term
XDR
XDR, or Extended Detection and Response, is a unified security platform that collects and correlates data across multiple security layers—endpoints, networks, servers, cloud workloads, and email—to improve threat detection and enable faster response.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.