What Actions Can Automation Rules Perform in Microsoft Sentinel?
Which THREE actions can be performed by automation rules in Microsoft Sentinel?
Quick Answer
The answer is that automation rules in Microsoft Sentinel can perform actions including adding a tag to an incident, assigning incidents to an owner, and running a playbook. These actions are correct because automation rules are designed to streamline incident response by automatically applying predefined workflows based on triggers like incident creation or update, allowing analysts to focus on investigation rather than manual triage. On the SC-200 exam, this topic tests your understanding of how automation rules differ from analytics rules and playbooks, often appearing in multiple-choice questions where a common trap is confusing run playbook with run a query or change a status. A key memory tip is to remember the three core actions as TAP: Tag, Assign, and Playbook, which covers the only incident-level modifications automation rules can directly apply without requiring a Logic App.
⚠ Common exam trap
It's easy for candidates to confuse automation rules with analytics rules or data connectors, assuming automation rules can modify data sources or create detection logic, when in fact automation rules are limited to post-ingestion incident management actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an incident to a specific owner
Automation rules in Microsoft Sentinel are designed to triage and manage incidents, so option C is correct because they can assign an incident to a specific owner (for example, setting the Owner field to a user or group) as part of incident handling. Option D is correct because automation rules can trigger a playbook on an incident, which is a core capability used to run automated response logic when an incident is created or updated. Option E is correct because automation rules can add tags to an incident, enabling classification, filtering, and later automation based on those tags. Options A and B are not correct: automation rules cannot modify a data connector to ingest more logs, and they cannot create a new analytics rule; those are configuration tasks performed through the Sentinel data connectors and analytics rule creation interfaces, not through incident automation rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify a data connector to ingest more logs
Why it's wrong here
Automation rules trigger playbooks or modify, assign and close incidents; they cannot alter a data connector's ingestion configuration. It is tempting because connectors and automation both live in Sentinel, and connector changes would be correct when onboarding a new log source, but that is configured separately.
- ✗
Create a new analytics rule
Why it's wrong here
Automation rules act on incidents and alerts after an analytics rule fires; they cannot author new analytics rules. It is tempting because both features are configured in Sentinel, and creating analytics rules would be correct when defining detections, but automation rules only orchestrate responses to existing ones.
- ✓
Assign an incident to a specific owner
Why this is correct
Automation rules respond to incident creation by applying triage actions, and owner assignment is one of the supported operations. The rule can route an incident to a named analyst or group automatically, removing manual queue handling without invoking a logic app.
- ✓
Run a playbook on an incident
Why this is correct
Automation rules can trigger a playbook against the incident that fired them, which is the mechanism for orchestrating remediation. The rule passes the incident context to the logic app, enabling automated enrichment or response as part of triage.
- ✓
Add a tag to an incident
Why this is correct
Tagging is a native automation rule action, letting rules classify incidents by source, severity or campaign for later filtering and reporting. The tag is applied automatically when the rule's conditions match, supporting consistent incident taxonomy.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)
hard- ✓ A.Change the severity of an incident.
- B.Delete an incident.
- ✓ C.Run a playbook.
- D.Add tags to an incident.
- E.Modify an existing analytics rule.
Why A: Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.
Variation 2. Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)
medium- A.Delete a watchlist
- B.Create a task
- C.Modify an analytics rule
- ✓ D.Assign incident to an analyst
- ✓ E.Run a playbook
Why D: Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.
Variation 3. Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?
easy- A.Create a new analytics rule
- B.Query Log Analytics workspaces
- ✓ C.Run a playbook
- ✓ D.Change the incident severity
- E.Ingest data from a new source
Why C: Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.
Variation 4. Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)
medium- ✓ A.Create a task on an incident
- ✓ B.Run a playbook on an incident
- C.Create an incident automatically
- D.Create a new automation rule
- E.Send an email notification
Why A: Option A is correct because Microsoft Sentinel automation rules support the "Create task" action, which adds a task to an incident for analyst follow-up. Option B is correct because automation rules can trigger a playbook (Logic App) to run against an incident, which is one of their primary purposes. Option C is not correct because incident creation is handled by analytics rules, not automation rules. Option D is not correct because automation rules cannot create other automation rules. Option E is not correct because sending an email is done by a playbook, not directly by an automation rule action.
Variation 5. Which TWO actions can you perform using Microsoft Sentinel automation rules?
medium- A.Create a new analytics rule based on an incident.
- ✓ B.Assign an incident to a specific analyst.
- C.Modify the data connector's polling interval.
- ✓ D.Run a playbook automatically when an incident is created.
- E.Automatically create an incident from a log event.
Why B: Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.
Variation 6. Which TWO actions can you perform using Microsoft Sentinel automation rules?
medium- A.Create a new analytics rule
- B.Modify a data connector
- ✓ C.Change incident status
- ✓ D.Run a playbook
- E.Delete an incident
Why C: Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.
Variation 7. Which THREE actions can you perform using Microsoft Sentinel automation rules?
hard- A.Create a new analytics rule
- B.Add threat intelligence indicators to Sentinel
- ✓ C.Run a playbook
- ✓ D.Change the severity of an incident
- ✓ E.Assign an incident to a specific analyst
Why C: Automation rules in Microsoft Sentinel can trigger a playbook as an automated response to an incident or alert. Playbooks are based on Azure Logic Apps and allow you to run complex workflows, such as gathering additional data, sending notifications, or taking remediation actions, directly from the automation rule.
Variation 8. Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)
medium- ✓ A.Assign an incident to a specific SOC analyst
- B.Modify a data connector's configuration
- C.Create a new analytics rule
- D.Create a new watchlist
- ✓ E.Run a playbook on an incident
Why A: Automation rules in Microsoft Sentinel allow you to automate incident management tasks, such as assigning incidents to specific SOC analysts based on criteria like severity or type. This is a core capability of automation rules, which can set the owner of an incident to a specific user or group, enabling efficient triage and accountability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.