easyMultiple ChoiceObjective-mapped
Which Table to Query for Microsoft Entra ID Role Changes
A SOC analyst wants to create a scheduled analytics rule in Microsoft Sentinel that detects when a user is added to a privileged Microsoft Entra ID role (e.g., Global Administrator). Which data table is essential for the query?
Quick Answer
The answer is the AuditLogs table. This is correct because the AuditLogs table in Microsoft Sentinel captures all directory-level audit activities, including modifications to Microsoft Entra ID role assignments, such as when a user is added to a privileged role like Global Administrator. The specific event is logged as an 'Add member to role' activity, making AuditLogs the essential data source for detecting these changes. On the SC-200 exam, this tests your understanding of which Sentinel table maps to specific identity events, often appearing in scenarios where you must distinguish between SigninLogs (authentication events) and AuditLogs (configuration changes). A common trap is confusing AuditLogs with the AADUserRiskEvents table, which only tracks user risk, not role assignments. For a quick memory tip, remember that any time a role or permission is changed in Entra ID, it is always an audit event—so think "AuditLogs for admin adds."
⚠ Common exam trap
Microsoft often tests the distinction between sign-in logs (SigninLogs) and audit logs (AuditLogs), trapping candidates who confuse authentication events with directory configuration changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AuditLogs
The AuditLogs table in Microsoft Sentinel captures all directory-level audit activities, including modifications to Microsoft Entra ID (formerly Azure AD) role assignments. When a user is added to a privileged role like Global Administrator, the event is logged as an 'Add member to role' activity in the AuditLogs table. This makes AuditLogs the essential data source for detecting such privileged role changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AuditLogs
Why this is correct
Correct. The AuditLogs table in Microsoft Sentinel (via Microsoft Entra ID connector) contains directory audit events, including changes to privileged role memberships.
- ✗
SigninLogs
Why it's wrong here
SigninLogs contains user sign-in events, not changes to directory roles. It is not used to detect role assignments.
- ✗
SecurityEvent
Why it's wrong here
SecurityEvent contains Windows security events from machines, such as local logon/logoff. It does not include Microsoft Entra ID role changes.
- ✗
CommonSecurityLog
Why it's wrong here
CommonSecurityLog is used for third-party security appliances (e.g., firewalls) sending CEF data. It does not contain Microsoft Entra ID audit events.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC analyst is creating a scheduled analytics rule in Microsoft Sentinel to detect when a user account is added to a privileged role in Microsoft Entra ID. The analyst wants to correlate with the user's previous role assignments to identify potential privilege escalation. Which table should the analyst query?
medium- ✓ A.AuditLogs
- B.SigninLogs
- C.AzureActivity
- D.SecurityEvent
Why A: The AuditLogs table in Microsoft Sentinel captures directory activity, including changes to privileged role assignments in Microsoft Entra ID (formerly Azure AD). By querying AuditLogs, the analyst can correlate the current role addition with historical role assignment events to detect potential privilege escalation. SigninLogs, AzureActivity, and SecurityEvent do not contain the specific role assignment audit data needed for this correlation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.