SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel with UEBA enabled. You notice that the UEBA entity pages are not showing any insights for Azure resources. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently confuse the Azure Activity data connector (which handles subscription-level logs) with the Azure Resource Manager data connector (which provides resource context data), leading them to incorrectly select Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The resource context data is not being ingested from Azure Resource Manager.
UEBA entity pages for Azure resources rely on resource context data, which includes metadata about Azure resources such as virtual machines, storage accounts, and their activities. This data is ingested from Azure Resource Manager (ARM) via the Azure Activity data connector. If the resource context data is not being ingested, UEBA cannot correlate activities to specific Azure resources, resulting in no insights on entity pages. Option D correctly identifies this missing data source as the root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
UEBA is not enabled for the workspace.
Why it's wrong here
The scenario explicitly states that UEBA is enabled, so this cannot be the root cause. UEBA is the feature that uses behavioral analytics; the issue is not that the feature is off, but that a specific data source feeding it, Azure Resource Manager resource context, is missing. Disabling UEBA would eliminate the insights altogether, whereas here the symptoms indicate the feature is running but lacks resource enrichment data.
- ✗
The user accounts are not synchronized with Microsoft Entra ID.
Why it's wrong here
User account synchronization with Microsoft Entra ID determines which identities are available for behavioral analytics, but it does not supply the resource context needed for Azure resource insights. Even if all user accounts are fully synchronized, UEBA would still miss Azure resource insights if the resource context from Azure Resource Manager is not ingested. Therefore, this option is unrelated to the missing resource context issue.
- ✗
The Azure Activity data connector is not configured.
Why it's wrong here
The Azure Activity data connector is not configured would affect audit events about resource operations, but it does not provide the dedicated resource context data from Azure Resource Manager that UEBA uses to lift Azure resource insights. Activity logs contain control-plane operation records, while UEBA's resource insight feature relies on metadata that associates users with resource hierarchy and properties. Thus, even enabling that connector would not fill the missing resource context gap.
- ✓
The resource context data is not being ingested from Azure Resource Manager.
Why this is correct
The correct cause is that resource context data from Azure Resource Manager is not being ingested. UEBA in Microsoft Sentinel requires this data to enrich entity insights with detailed Azure resource attributes, such as resource type and resource group, which are essential for displaying Azure resource insights. Without this ingestion, the UEBA feature will operate for user behaviors but lack the resource-specific context that drives the 'Azure resource insights' views.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.