SC-300 Certification Practice Question #189

Question

You have a Microsoft 365 E5 subscription and an Azure subscription.

You plan to analyze Microsoft Entra sign-in logs by using Azure Monitor.

You need to configure diagnostic settings for Microsoft Entra.

Which destination should you configure for the sign-in logs?

Accepted Answer

To analyze Microsoft Entra sign-in logs with Azure Monitor, the diagnostic-setting destination must be a Log Analytics workspace — that is where Azure Monitor runs KQL queries, builds visualizations, and raises alerts. MS Learn's Entra integration guide explicitly directs you to "Send to Log Analytics workspace" for this exact scenario. The other three destinations are wrong: an event hub streams logs to external/SIEM systems, a storage account only archives without analytics, and an Azure SQL database is not even an available diagnostic-settings destination. Suggested Answer, full community agreement, and MS Learn all converge on C.

More SC-300 practice questions