AZ-500 Question 267
Single answerYou have enabled the built-in Azure Active Directory data connector in Microsoft Sentinel to ingest sign-in logs for security investigations. However, after enabling the connector in the Sentinel portal, you notice that no sign-in logs are appearing in the associated Log Analytics workspace. Which of the following actions must you take to ensure that Azure AD sign-in logs will start flowing into Microsoft Sentinel?
- A
Configure Azure Activity Logs to capture Azure AD sign-in events and forward them to the same Log Analytics workspace.
- B
Grant the required admin consent in Azure AD for the permissions requested by the Microsoft Sentinel Azure Active Directory data connector.
- C
Assign the Owner role to the Microsoft Sentinel resource group within your Azure subscription.
- D
Enable ‘User Sign-In Forwarding’ in the Azure AD tenant’s properties to stream sign-in events to Microsoft Sentinel.
Show answer and explanation
Correct answer: B
Explanation
When configuring the Azure Active Directory data connector in Microsoft Sentinel, you must grant the connector permission to read sign-in and audit logs from Azure AD. Simply activating the connector in the Sentinel portal does not automatically provide the required Azure AD permissions. You need to grant admin consent for the specific permissions that the connector requests. Refer to Microsoft Sentinel’s official documentation for details on managing permissions and enabling data connectors: https://learn.microsoft.com/azure/sentinel/connect-azure-active-directory.
- A. Incorrect.
Incorrect. Azure Activity Logs capture Azure Resource Manager (ARM)-based activities, not Azure AD sign-ins. Relying on Azure Activity Logs alone will not ingest Azure AD sign-in events into Microsoft Sentinel.
- B. Correct.
Correct. Even after enabling the Azure AD data connector in Microsoft Sentinel, you must grant the requested API permissions for the connector in Azure AD. Without granting admin consent, Sentinel cannot read and ingest the sign-in logs.
- C. Incorrect.
Incorrect. Assigning the Owner role at the resource group level will not grant the specific permission needed to read Azure AD sign-in logs. Sentinel needs admin consent specifically for the Azure AD data connector.
- D. Incorrect.
Incorrect. There is no built-in feature called ‘User Sign-In Forwarding’ in Azure AD tenant settings. Ingesting sign-in logs requires enabling the Azure AD data connector in Sentinel and granting the necessary API permissions.