SC-200 Certification Practice Question #102

Question

You have an existing Azure logic app that is used to block Azure Active Directory (Azure AD) users. The logic app is triggered manually.
You deploy Azure Sentinel.
You need to use the existing logic app as a playbook in Azure Sentinel.
What should you do first?

Accepted Answer

The question asks what to do **first to use the existing logic app as a playbook**. MS Learn states a Sentinel playbook is a logic app whose workflow begins with a Microsoft Sentinel trigger (incident, alert, or entity); a logic app that "is triggered manually" therefore cannot function as a playbook until its trigger is changed — making D the correct first step for the stated goal. Both the Suggested Answer and the Most Voted (34 votes), plus the top comment (👍44), align on D. Confidence is capped at 80 rather than higher because there is a substantial, well-reasoned minority (JhnCanthern12 👍26, plus madhatter/PJR/haskelatchi) arguing B — the data connector — on the grounds that a just-deployed Sentinel has no data; that view is defensible but answers a different objective (getting AAD data in) than the one the question states (reusing the logic app as a playbook), so D is the better-supported answer while the genuine community split keeps confidence in the 75-81 band.

More SC-200 practice questions