SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel with UEBA enabled. You are investigating a suspicious incident where a user's account is reported to have accessed an unusual amount of data from a SharePoint site. The incident alert points to the user 'jdoe@contoso.com'. You open the incident and see that the entity timeline for jdoe shows several activities, including file downloads. However, you notice that the timeline does not include any Microsoft Entra ID sign-in events for this user. You need to include sign-in events in the entity timeline to get a complete picture. What should you do?
⚠ Common exam trap
A common mix-up: candidates confuse the Office 365 connector (which handles SharePoint, Exchange, Teams) with the Microsoft Entra ID connector (which handles sign-in and audit logs), leading them to choose Option C instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the Microsoft Entra ID connector to ingest sign-in logs.
The entity timeline in Microsoft Sentinel relies on data already ingested into the workspace. Since Microsoft Entra ID sign-in events are not appearing, the most likely cause is that the Microsoft Entra ID connector has not been installed or configured. Installing this connector ingests sign-in logs (and audit logs) into Sentinel, which then populates the entity timeline with sign-in activities for users like jdoe.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Install the Microsoft Entra ID connector to ingest sign-in logs.
Why this is correct
Installing the Microsoft Entra ID (Azure AD) connector is the required first step because Microsoft Sentinel does not natively ingest cloud identity auditing data. This connector pulls SigninLogs and AuditLogs into the Log Analytics workspace, which UEBA's behavioral profiling engine then consumes to generate entity timelines and spot anomalous identity activity. Without those sign-in logs, UEBA has no identity-related raw data to analyze, so enabling the feature alone accomplishes nothing.
- ✗
Enable UEBA for Microsoft Entra ID in the Sentinel settings.
Why it's wrong here
UEBA is a workspace-level capability in Microsoft Sentinel, toggled on in the Entity behavior settings for the entire Log Analytics workspace, not a feature that can be enabled per source such as Microsoft Entra ID. There is no 'Enable UEBA for Microsoft Entra ID' option; the setting applies globally, and the Microsoft Entra ID connection simply supplies data once the connector is installed. Attempting to enable UEBA for a single source misrepresents how the feature's configuration and data collection are decoupled.
- ✗
Install the Office 365 connector to ingest Microsoft Entra ID logs.
Why it's wrong here
The Office 365 connector brings in Exchange Online, Teams, and SharePoint Online activity from the Office 365 Management Activity API, but sign-in events are not part of that surface. Microsoft Entra ID sign-in logs (SigninLogs) are delivered exclusively through the Microsoft Entra ID connector, which also retrieves Microsoft Entra ID AuditLogs for scenarios such as dormant account detection. Choosing the Office 365 connector leaves UEBA without the successful and failed authentication events it needs for risk analysis.
- ✗
Configure the entity timeline to include Microsoft Entra ID events manually.
Why it's wrong here
The entity timeline is generated automatically by Sentinel's UEBA engine from normalized entities and already-ingested data sources, so there is no manual configuration to force it to display specific Microsoft Entra ID events. Adjusting the timeline's display range or filters is possible, but the underlying events appear only if they have been collected through the appropriate data connectors into Log Analytics. Trying to manually inject Microsoft Entra ID events would violate the out-of-the-box data flow that populates entity profiles.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.