Automating User Suspension in Microsoft Entra ID from Sentinel Playbook
A company uses Microsoft Sentinel with Microsoft Defender for Cloud Apps. An incident is created when a user downloads 500 GB from SharePoint in one hour. The analyst wants to create a playbook that automatically suspends the user in Microsoft Entra ID when such activity is detected. Which connector and action should the analyst use in the playbook?
Quick Answer
The correct answer is the Microsoft Entra ID connector with the 'Update user' action to set accountEnabled to false. This works because the Microsoft Entra ID connector provides direct access to modify user objects in the directory, and the 'Update user' action includes a property to toggle account status, effectively suspending the user by disabling their sign-in capability. On the SC-200 exam, this scenario tests your understanding of which connectors have native user management actions versus those that only monitor or alert; a common trap is choosing the Defender for Cloud Apps connector, which can detect the activity but lacks a direct user-disable action, or the Exchange Online connector, which only manages mailbox settings. To remember this, think of the phrase "Entra ID to disable, Defender to enable detection"—the detection happens in Defender for Cloud Apps, but the actual suspension requires Entra ID’s user update action.
⚠ Common exam trap
The SC-200 exam often tests the distinction between notification actions (like Teams posts) and remediation actions (like disabling a user account), and the trap here is that candidates may choose a notification option (A) because it seems proactive, but the question explicitly requires automatic suspension, not just alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.
The Microsoft Entra ID connector provides the 'Update user' action, which can set the 'accountEnabled' property to false, effectively suspending the user in Microsoft Entra ID. This directly addresses the requirement to automatically disable a user account when a high-volume SharePoint download incident is detected in Microsoft Sentinel. The playbook can be triggered by the incident and use this action to perform the suspension without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Teams connector with 'Post message' action to notify admin.
Why it's wrong here
Only notifies, does not disable.
- ✓
Microsoft Entra ID connector with 'Update user' action to set accountEnabled to false.
Why this is correct
Directly disables the user account in Entra ID.
- ✗
Microsoft 365 Defender connector with 'Run advanced hunting' action.
Why it's wrong here
Cannot disable user accounts.
- ✗
Exchange Online connector with 'Set mailbox' action.
Why it's wrong here
Disables mailbox, not user account.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Contoso uses Microsoft Sentinel with the Microsoft Defender for Cloud Apps connector. An incident is generated: 'Unusual file download by user - possible data exfiltration.' The incident shows that a user downloaded 500 files from SharePoint Online within 10 minutes, which is abnormal for that user. The user's account shows no other suspicious activity. You need to respond. Which of the following is the BEST first action?
easy- A.Block SharePoint Online access for all users temporarily.
- B.Create an anomaly detection policy for such downloads.
- ✓ C.Suspend the user account in Microsoft Entra ID.
- D.Investigate the user's recent activity logs.
Why C: Suspending the user account in Microsoft Entra ID immediately stops any further downloads and prevents potential data exfiltration. Option A is wrong: blocking SharePoint Online for all users is too disruptive and may not be necessary. Option B is wrong: creating an anomaly detection policy is a long-term improvement, not an immediate response. Option D is wrong: investigating logs is important but should be done after stopping the active threat.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.