MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A security analyst wants to automatically create a Microsoft Teams message in a dedicated security channel whenever a Microsoft 365 Defender incident with severity 'High' is created. Which automation approach should the analyst use?
⚠ Common exam trap
A common mix-up: candidates confuse 'automation rules' in Defender (which handle response actions like isolation) with external notification workflows, leading them to choose Option B instead of recognizing that Power Automate is the correct integration tool for sending Teams messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Power Automate
Power Automate is the correct choice because it provides a no-code/low-code workflow that can be triggered by Microsoft 365 Defender's 'When an incident is created or updated' connector, filter for severity 'High', and then post a message to a dedicated Teams channel via the 'Post a message in a chat or channel' action. This directly meets the requirement for automatic, event-driven notification without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Power Automate
Why this is correct
Power Automate flows offer a native trigger for Microsoft 365 Defender incidents, such as 'When an incident is created or updated,' and can then use the Microsoft Teams connector's 'Post message in a chat or channel' action to send a message to a specific channel. This low-code solution allows filtering by severity (e.g., High), supports adaptive cards for rich context, and can automatically execute without human intervention. It is the standard tool for integrating Defender incident generation with Teams notifications.
- ✗
Automation rules in Defender
Why it's wrong here
Automation rules in Microsoft 365 Defender can manage incident lifecycle properties—like setting status, owner, and classification—and can invoke playbooks, but they lack a built-in action to post directly to Teams. Even when a rule triggers a playbook, that playbook is a Power Automate flow, meaning the automation rule itself cannot natively fulfill the requirement. Therefore, automation rules alone are insufficient for sending Teams messages automatically.
- ✗
Microsoft Graph API
Why it's wrong here
Microsoft Graph API is unsuitable because it lacks an inherent trigger mechanism for Microsoft 365 Defender incidents. It cannot automatically detect when a 'High' severity incident is created; another service would be required to poll for such events. This option is tempting as the Graph API does provide the necessary programmatic interface to create messages within Microsoft Teams. It is the correct choice for custom applications or scripts that require direct, programmatic access to read or write Microsoft 365 data and perform actions, often as a component within a broader automation solution.
- ✗
Action Center
Why it's wrong here
The Action Center in Microsoft 365 Defender is a review queue for pending automated investigation and response actions, requiring human approval or manual execution. It does not provide a mechanism to trigger external notifications or post messages to Teams; it simply lists actions awaiting confirmation. Thus, it acts as an approval console rather than a notification service, making it irrelevant for this scenario.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Microsoft Teams
Microsoft Teams is a collaboration platform that integrates chat, video meetings, file storage, and application integration into a single workspace, primarily used within the Microsoft 365 ecosystem.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.