SC-200 Certification Practice Question #187

Question

You have a Microsoft 365 E5 subscription.

You need to configure Microsoft Sentinel to collect logs from Microsoft Entra.

Which two nodes should you use in the Microsoft Defender portal? To answer, select the appropriate nodes in the answer area.

NOTE: Each correct answer is worth one point.

Accepted Answer

Collecting Microsoft Entra logs into Sentinel is a two-step ingestion flow. First you install the **Microsoft Entra ID** solution from the **Content hub** (Content management) so the connector becomes available; then you open **Data connectors** (Configuration), select the Microsoft Entra ID connector, and choose the log types (SigninLogs, AuditLogs, etc.) to stream. MS Learn documents exactly this Content hub → Data connectors sequence, and the Defender-portal guidance reiterates that the connector won't appear under Data connectors unless its solution is installed from the Content hub. The other menu nodes operate on data that already exists in the workspace, so they don't configure collection.

More SC-200 practice questions