Automatically Disable User Account in Azure AD Using Microsoft Sentinel Playbook
Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?
Quick Answer
The correct component is a playbook that uses the Microsoft Graph API to disable the user. This is because a playbook in Microsoft Sentinel is an automated workflow, typically built on Azure Logic Apps, that can be triggered directly by a high-severity incident. By incorporating the Microsoft Graph API into that workflow, you can programmatically modify the user’s account status in Microsoft Entra ID, providing the precise automated response required. On the SC-200 exam, this question tests your understanding of how to integrate Sentinel’s incident-driven automation with identity management—a common scenario where candidates mistakenly choose a workbook or analytics rule instead of a playbook. The key trap is confusing detection (analytics rules) with automated response (playbooks). Remember the memory tip: “Playbooks act, workbooks track”—if you need to automatically disable a user, you need an action, not a report.
⚠ Common exam trap
Many exam-takers confuse automation rules with playbooks, thinking that automation rules can directly execute scripts or API calls, when in fact automation rules only trigger playbooks or run actions like changing incident status, not performing external remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A playbook that uses the Microsoft Graph API to disable the user.
A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A playbook that uses the Microsoft Graph API to disable the user.
Why this is correct
Playbooks can automate response actions like disabling a user.
- ✗
An analytics rule that includes a query to disable the user.
Why it's wrong here
Analytics rules only create incidents.
- ✗
An automation rule that runs a PowerShell script on a hybrid worker.
Why it's wrong here
Automation rules trigger playbooks; they don't run scripts directly.
- ✗
A workbook that triggers a webhook to disable the user.
Why it's wrong here
Workbooks are not designed for automation.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?
easy- A.Create an analytics rule that directly sends an email.
- B.Create a workbook that triggers a webhook.
- C.Create an automation rule that sends an email and creates a ticket.
- ✓ D.Create a playbook in Microsoft Sentinel and trigger it with an automation rule.
Why D: Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.