SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You have a custom analytics rule that triggers on a Defender for Endpoint alert. When the rule triggers, a playbook is executed that creates an incident in Microsoft Sentinel and sends a message to a Teams channel. The playbook fails to execute. Which permission should you verify first?
⚠ Common exam trap
The trap here is that candidates often focus on the downstream action (Teams webhook) or user roles (Reader, Global Admin) instead of the critical link between the automation rule and the playbook execution permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The automation rule has the correct managed identity or connection permissions
The playbook executes as part of an automation rule triggered by a custom analytics rule. For the playbook to run successfully, the automation rule must have the correct permissions to invoke the playbook. This is typically configured via a managed identity (recommended) or a connection resource. Without this, the automation rule cannot trigger the playbook, regardless of other permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Teams channel has the appropriate permissions for incoming webhooks
Why it's wrong here
Teams incoming webhook permissions govern whether external messages can be posted to a Teams channel; they do not control how Microsoft Sentinel triggers or executes a Logic App playbook. If the playbook runs and attempts to send a notification, a webhook misconfiguration would only cause the notification step to fail, not block the automated playbook execution itself. Therefore, webhook permissions are not the root cause of a playbook failing to run from an automation rule.
- ✗
The analyst has Microsoft Sentinel Reader role
Why it's wrong here
Microsoft Sentinel Reader is an RBAC role that grants read-only access to Sentinel resources, such as incidents, workbooks, and analytics rules; it does not grant permission to execute or modify playbooks. Moreover, automation rules run under their own configured identity (managed identity or connection), not under the identity of the analyst who created or views the rule. As a result, whether the analyst holds the Reader role is irrelevant to the automation rule's ability to invoke a playbook.
- ✗
The user has Microsoft Entra ID Global Administrator role
Why it's wrong here
Microsoft Entra ID Global Administrator is a tenant-wide directory role that does not map to the specific Azure RBAC permissions required to trigger a Logic App used as a Sentinel playbook. Playbook execution depends on identity permissions granted directly on the Logic App resource, such as via a managed identity role assignment or an approved OAuth connection. Holding Global Admin does not automatically grant those execution permissions, nor is that role required for automation rules to work, so it is not the cause of the failure.
- ✓
The automation rule has the correct managed identity or connection permissions
Why this is correct
Automation rules in Microsoft Sentinel invoke playbooks by using either a managed identity or an OAuth connection to authenticate against the Logic App resource. If the managed identity lacks the required RBAC role on the Logic App (for example, Logic App Operator), or if the connection used by the rule has been removed, expired, or lacks the necessary permissions, the automation rule cannot trigger the playbook. This is the most direct and common cause of playbook execution failure, making it the correct answer.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.