How to Send On-Premises Windows Server Security Alerts to Microsoft Sentinel
Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?
Quick Answer
The answer is to first onboard the servers to Azure Arc and enable Defender for Cloud. This is correct because Azure Arc establishes a management identity and secure connectivity for on-premises Windows Server 2022 machines, allowing Defender for Cloud to apply security policies and forward alerts to Microsoft Sentinel. Without Arc, the servers are invisible to Azure’s control plane, so alerts cannot be collected or routed. On the SC-200 exam, this tests your understanding of hybrid security prerequisites—a common trap is assuming you can directly install the Azure Monitor Agent or connect Sentinel without Arc. Remember, Arc is the bridge: no Arc, no Defender for Cloud policy enforcement, no alert forwarding. Memory tip: “Arc first, alerts forward.”
⚠ Common exam trap
It's easy for candidates to assume installing an agent (AMA or MDE) is sufficient to forward alerts to Sentinel, but Microsoft requires Azure Arc as the foundational onboarding step to bring non-Azure servers into the Azure management plane before Defender for Cloud can generate and forward security alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Onboard the servers to Azure Arc and enable Defender for Cloud.
On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install the Azure Monitor Agent on the servers.
Why it's wrong here
Azure Monitor Agent collects telemetry and forwards it to Log Analytics, but without Azure Arc onboarding the servers have no connected machine identity for Defender for Cloud to surface alerts into Microsoft Sentinel. Arc enrolment is the prerequisite step here.
- ✗
Deploy Azure Policy to enable Defender for Cloud on the servers.
Why it's wrong here
Azure Policy assigns and configures Defender for Cloud plans, but onboarding non-Azure servers requires Azure Arc first; without the Arc agent, policy cannot reach them. It is tempting because policy-driven enablement is the standard route for Azure VMs, and would be correct once the servers are Arc-connected.
- ✓
Onboard the servers to Azure Arc and enable Defender for Cloud.
Why this is correct
Azure Arc enrolment is the prerequisite: it projects the on-premises Windows Server 2022 machines into Azure as connected resources, which Defender for Cloud requires before its agent can stream security alerts into Microsoft Sentinel. Without Arc, the servers remain invisible to the connector.
- ✗
Install Microsoft Defender for Endpoint on the servers.
Why it's wrong here
Defender for Endpoint provides endpoint detection and response, not the Arc-based agent that forwards Defender for Cloud alerts into Microsoft Sentinel. It is tempting because it protects Windows Server 2022, and would be correct for endpoint-level threat detection rather than hybrid alert ingestion.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?
medium- A.Install a third-party SIEM connector on the servers and forward logs to Sentinel.
- B.Deploy Azure Policy on the servers to audit security settings.
- ✓ C.Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.
- D.Configure a site-to-site VPN to Azure and enable network logging.
Why C: Azure Arc enables on-premises servers to be managed as Azure resources, allowing the Log Analytics agent to be deployed and configured to forward security alerts to a Log Analytics workspace integrated with Microsoft Sentinel. This is the standard method for ingesting security events from hybrid workloads into Sentinel without requiring third-party connectors or complex network configurations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.