SC-200 Certification Practice Question #112

Question

You are configuring Azure Sentinel.
You need to send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected.
Which two actions should you perform in Azure Sentinel? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

Sending a Microsoft Teams channel message in response to a suspicious sign-in is exactly the orchestration/notification use case for a Sentinel playbook (built on Logic Apps), and the official "Post a message in a Microsoft Teams channel" template confirms the playbook is the mechanism. You must first (A) add/create the playbook with the Teams action, then (B) wire it to fire on the incident (via the incident trigger / automation rule). The community is essentially unanimous on AB and the suggested answer only captures half (B). The phrasing of B is imperfect — you formally attach a playbook to an automation rule rather than directly to an incident — but among the offered options A and B are the only two that produce a Teams message, so confidence is high but not maximal due to that wording and the Suggested-vs-Most-Voted partial mismatch.

More SC-200 practice questions