How to Send On-Premises Windows Server Security Alerts to Microsoft Sentinel
Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers running Windows Server 2022 are forwarded to Microsoft Sentinel. The servers are not yet onboarded to Azure Arc. What should you do first?
Quick Answer
The answer is to first onboard the servers to Azure Arc and enable Defender for Cloud. This is correct because Azure Arc establishes a management identity and secure connectivity for on-premises Windows Server 2022 machines, allowing Defender for Cloud to apply security policies and forward alerts to Microsoft Sentinel. Without Arc, the servers are invisible to Azure’s control plane, so alerts cannot be collected or routed. On the SC-200 exam, this tests your understanding of hybrid security prerequisites—a common trap is assuming you can directly install the Azure Monitor Agent or connect Sentinel without Arc. Remember, Arc is the bridge: no Arc, no Defender for Cloud policy enforcement, no alert forwarding. Memory tip: “Arc first, alerts forward.”
⚠ Common exam trap
It's easy for candidates to assume installing an agent (AMA or MDE) is sufficient to forward alerts to Sentinel, but Microsoft requires Azure Arc as the foundational onboarding step to bring non-Azure servers into the Azure management plane before Defender for Cloud can generate and forward security alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Onboard the servers to Azure Arc and enable Defender for Cloud.
On-premises servers must first be onboarded to Azure Arc to establish a management identity and connectivity with Azure. Without Azure Arc, Defender for Cloud cannot apply its security policies or forward alerts to Microsoft Sentinel. Enabling Defender for Cloud on the servers after Arc onboarding allows security alerts to be collected and forwarded to Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install the Azure Monitor Agent on the servers.
Why it's wrong here
AMA requires Arc or Azure VMs; without Arc, installation fails.
- ✗
Deploy Azure Policy to enable Defender for Cloud on the servers.
Why it's wrong here
Azure Policy cannot target non-Azure resources without Arc.
- ✓
Onboard the servers to Azure Arc and enable Defender for Cloud.
Why this is correct
Arc provides the identity and management needed for Defender for Cloud to monitor on-prem servers.
- ✗
Install Microsoft Defender for Endpoint on the servers.
Why it's wrong here
Defender for Endpoint alone does not integrate with Sentinel via Defender for Cloud.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender for Cloud to monitor hybrid workloads. You need to ensure that security alerts from on-premises servers are sent to Microsoft Sentinel. What should you configure?
medium- A.Install a third-party SIEM connector on the servers and forward logs to Sentinel.
- B.Deploy Azure Policy on the servers to audit security settings.
- ✓ C.Connect the on-premises servers to Azure Arc and deploy the Log Analytics agent.
- D.Configure a site-to-site VPN to Azure and enable network logging.
Why C: Azure Arc enables on-premises servers to be managed as Azure resources, allowing the Log Analytics agent to be deployed and configured to forward security alerts to a Log Analytics workspace integrated with Microsoft Sentinel. This is the standard method for ingesting security events from hybrid workloads into Sentinel without requiring third-party connectors or complex network configurations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.