SC-200 Certification Practice Question #252

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace.

You need to create and customize a workbook for the Microsoft Entra ID Audit Logs.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

To create and customize a Microsoft Sentinel/Entra workbook you first make it available by **installing the Microsoft Entra ID solution from the Content hub**, then **View Template** to open the prebuilt Microsoft Entra ID Audit Logs workbook, then **Save** to create your own editable instance — exactly the install → View template → Save flow MS Learn documents for customizing template workbooks. The top Highly Voted answer and two corroborating comments all give this order. Confidence is held to ~80% because a competing 5-👍 Highly Voted answer leads with "Configure a Data connector," reflecting a genuine community split over whether data-connector setup belongs in the three steps; the data connector concerns ingesting logs, not creating/customizing the workbook, so it is excluded here.

More SC-200 practice questions