SC-200 Certification Practice Question #122

Question

You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector.
You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert.
What should you create first?

Accepted Answer

A Sentinel logic app is launched by a **playbook**, and a playbook is attached to an **automation rule** that runs "when an alert is created." MS Learn confirms automation rules can be alert-triggered and are the mechanism that runs playbooks/Logic Apps in response to alerts. The dissent (analytics rule, option C) reasons that an alert must first be generated — but the question's wording, "when Microsoft Sentinel detects an Azure AD-generated alert," together with the already-enabled Azure AD connector, presumes the alerts already exist; the task is only to launch app1 in response. Both the Suggested Answer and the strongest community votes (28 Most Voted, plus the two highest-👍 selections) choose D. Confidence is held in the mid-80s because a notable minority insists an analytics rule is the true first step.

More SC-200 practice questions