Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete+

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete−

Learning path 06 · Connect logs to Microsoft Sentinel ↗

7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence

Study focus

Data onboarding

Select and configure connectors for Microsoft services, Defender, Windows, CEF, and Syslog sources.

Collection reliability

Plan agents, data collection rules, forwarding, destination tables, threat indicators, and ingestion validation.

7 modules · 49 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Connect data to Microsoft Sentinel using data connectors0/6 units+02Connect Microsoft services to Microsoft Sentinel0/8 units−03Connect Microsoft Defender XDR to Microsoft Sentinel0/8 units+04Connect Windows hosts to Microsoft Sentinel0/7 units+05Connect Common Event Format logs to Microsoft Sentinel0/5 units+06Connect Syslog data sources to Microsoft Sentinel0/7 units+07Connect threat indicators to Microsoft Sentinel0/8 units+

Module 2

Connect Microsoft services to Microsoft Sentinel

Focus: Microsoft 365, Microsoft Entra, Identity Protection, and Azure Activity connectors.

0/8

01 / 08Introduction

Microsoft service connectors bring audit, identity, risk, and Azure control-plane signals into Sentinel. Each connector has distinct permissions, tables, pricing implications, and incident behavior.

Official moduleMicrosoft connector objectives

02 / 08Plan for Microsoft services connectors

Connector	Primary output
Microsoft 365	Exchange, SharePoint, and Teams audit records in `OfficeActivity`.
Microsoft Entra ID	Separate tables for audit, user, service principal, managed identity, provisioning, and AD FS sign-ins.
Entra ID Protection	Risk alerts in `SecurityAlert`; optional incident creation rule.
Azure Activity	Subscription and ARM control-plane events in `AzureActivity`.

Select only log types required by detection and investigation use cases, while retaining enough identity and audit context.

Official lessonService-to-table planning

03 / 08Connect the Microsoft 365 connector

Install the Microsoft 365 solution, open its connector, verify prerequisites, select Exchange, SharePoint, and/or Teams record types, and apply changes. Wait until validation completes and the action changes to Disconnect.

Use OfficeActivity to investigate mailbox changes, file access and downloads, sharing activity, group changes, Teams operations, and the responsible user.

Official lessonMicrosoft 365 audit ingestion

04 / 08Connect the Microsoft Entra connector

Log type	Table
Interactive user sign-ins	`SigninLogs`
Non-interactive sign-ins	`AADNonInteractiveUserSignInLogs`
Service principal sign-ins	`AADServicePrincipalSignInLogs`
Managed identity sign-ins	`AADManagedIdentitySignInLogs`
Provisioning	`AADProvisioningLogs`
AD FS sign-ins	`ADFSSignInLogs`
Directory audit	`AuditLogs`

Install the Entra ID solution, open the connector, select required streams independently, and connect. Ingestion scope directly affects cost and detection coverage.

Official lessonEntra sign-in and audit streams

05 / 08Connect the Microsoft Entra ID Protection connector

Install the Identity Protection solution, open the connector, and connect risk alerts. Enabling automatic incident creation activates the default analytics rule that converts ingested Identity Protection alerts into Sentinel incidents.

The connector supplies alert context, not all underlying identity telemetry. Combine it with Entra sign-in and audit logs for investigation.

Official lessonRisk alerts and incident creation

06 / 08Connect the Azure Activity connector

Azure Activity captures subscription-level ARM operations, resource writes, service-health events, and operation status. The connector uses Azure Policy to deploy the subscription-to-workspace streaming configuration.

Install Azure Activity and open the connector.
Launch the Azure Policy assignment wizard and select subscription scope.
Select the primary Log Analytics workspace.
Create a remediation task so existing subscriptions receive the configuration.

The lesson requires Owner on the relevant subscription.

Official lessonPolicy-based Azure Activity ingestion

07 / 08Module assessment

Match Microsoft services to their tables, permissions, selectable streams, alert-versus-raw-data behavior, and Azure Policy deployment requirements.

Official assessmentMicrosoft connectors knowledge check

08 / 08Summary and resources

Connect the minimum set of service streams that satisfies audit and detection requirements, then validate both connector health and representative rows in every expected table.

Official moduleSummary and resources

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete+

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+