AZ-500 Question 271
Select 3Your organization wants to automate a high-severity incident response in Microsoft Sentinel. Specifically, when a high-severity incident is created, it should trigger a Logic App playbook that quarantines potentially compromised user accounts in Azure AD. Which three steps must you take to ensure the playbook runs automatically and has the required permissions to perform the quarantine action?
- A
- Configure an Automation Rule in Microsoft Sentinel that filters for ‘Incident severity = High’ and sets ‘Run playbook’ as the action.
- B
- In the Logic App, enable the built-in Sentinel trigger (When a response to an Azure Sentinel alert is triggered).
- C
- Use an outbound email connector in the Logic App to re-send alerts to cloud-based email security services for processing.
- D
- Assign the Microsoft Sentinel Responder or Microsoft Sentinel Contributor role to the Logic App’s managed identity so it can perform quarantine actions.
Show answer and explanation
Correct answers: A, B, D
Explanation
To configure automation in Microsoft Sentinel, you must create an Automation Rule that conditions on specific incident properties (like severity) and calls a Logic App playbook. The playbook itself must have the Microsoft Sentinel trigger so it can receive the incident details upon creation. Additionally, the playbook’s managed identity needs sufficient RBAC permissions (typically Microsoft Sentinel Responder or Contributor) to perform required remediation actions such as quarantining users in Azure AD. For more details, refer to official Microsoft Sentinel documentation, particularly the sections on ‘Create and manage automation rules’ and ‘Use playbooks with automation rules.’
- A. Correct.
Option 1 is correct. You must create an Automation Rule in Microsoft Sentinel and specify the condition (e.g., ‘Incident severity = High’) and the action (‘Run playbook’). This ensures that any new high-severity incident automatically triggers the associated playbook.
- B. Correct.
Option 2 is correct. The Logic App must have the appropriate Sentinel trigger, commonly called ‘When a response to an Azure Sentinel alert is triggered’, so that it is invoked whenever the Automation Rule runs the playbook in response to an incident.
- C. Incorrect.
Option 3 is incorrect. Simply sending an outbound email does not help the Logic App listen for Microsoft Sentinel alerts. While email notifications might be useful for additional alerting, it does not enable automatic incident-driven triggers in Sentinel itself.
- D. Correct.
Option 4 is correct. The Logic App’s managed identity requires the Microsoft Sentinel Responder or Microsoft Sentinel Contributor role to perform quarantine actions within Azure AD or take other remediation steps. Without these permissions, the Logic App will fail when attempting elevated tasks.