SC-300 · Domain 4: Plan and automate identity governance · 23% of the exam
Task 4.4: Monitor identity activity by using logs, workbooks, and reports
Sign-in, audit and provisioning logs, diagnostic settings and their destinations, KQL in Log Analytics, workbooks and reports, and Identity Secure Score.
Study it
Sign-in, audit and provisioning logs and diagnostic settings
KQL in Log Analytics, workbooks and Identity Secure Score
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 2
Contoso must query Microsoft Entra sign-in and audit logs with KQL for the last 90 days and keep them for two years at the lowest cost for auditors. Which two destinations should the diagnostic setting send to? (Choose TWO.)
AAn Azure event hub
BA partner solution integration
CThe Microsoft 365 unified audit log
DA Log Analytics workspace
EAn Azure storage account
Show the answer and why
AAn Azure event hub
Incorrect
An event hub isn't a store that keeps logs for KQL queries or for a two-year archive.
BA partner solution integration
Incorrect
Partner integrations send logs to a third-party product, not for KQL or archive in Azure.
CThe Microsoft 365 unified audit log
Incorrect
The unified audit log isn't a diagnostic setting destination for Microsoft Entra logs.
DA Log Analytics workspace
Correct
Log Analytics stores the logs for KQL queries.
EAn Azure storage account
Correct
A storage account archives logs at low cost for long retention.
Microsoft Entra diagnostic settings send activity logs to a Log Analytics workspace, a storage account, an event hub or a partner solution. KQL queries run against a Log Analytics workspace, and a storage account archives the logs at low cost for long retention, so the two together meet both needs.
A diagnostic setting sends SignInLogs and AuditLogs to Log Analytics. An analyst needs to find every sign-in by the Billing-Sync app, which signs in with a client secret and no user, but queries of the SigninLogs table return nothing for it. What should you do?
AQuery the AADNonInteractiveUserSignInLogs table instead of SigninLogs
BAdd the ManagedIdentitySignInLogs category to the diagnostic setting and query AADManagedIdentitySignInLogs
CAdd the ServicePrincipalSignInLogs category to the diagnostic setting and query AADServicePrincipalSignInLogs
DQuery the AuditLogs table for Sign-in activity by the app
Show the answer and why
AQuery the AADNonInteractiveUserSignInLogs table instead of SigninLogs
Incorrect
Non-interactive user sign-ins are made on behalf of a user, not by an app alone.
BAdd the ManagedIdentitySignInLogs category to the diagnostic setting and query AADManagedIdentitySignInLogs
Incorrect
That category covers managed identities, not an app registration that uses a client secret.
CAdd the ServicePrincipalSignInLogs category to the diagnostic setting and query AADServicePrincipalSignInLogs
Correct
App-only sign-ins with secrets or certificates are a separate log category and table.
DQuery the AuditLogs table for Sign-in activity by the app
Incorrect
Audit logs record directory changes, not sign-ins.
Microsoft Entra sign-in logs are split into categories: interactive user (SignInLogs), non-interactive user, service principal (apps authenticating with secrets or certificates) and managed identity sign-ins. Each category must be selected in the diagnostic setting and lands in its own table, such as AADServicePrincipalSignInLogs.
Contoso enforces MFA for privileged accounts with a non-Microsoft product, and the matching Identity Secure Score improvement action still shows as not done. Contoso wants the score to reflect that the control is in place. Which status should you set?
ARisk accepted
BPlanned
CResolved through third party
DIgnored
Show the answer and why
ARisk accepted
Incorrect
Accepting the risk awards no points and says the control isn't in place.
BPlanned
Incorrect
Planned says work is still to come and awards no points.
CResolved through third party
Correct
This status awards the action's points when another product covers the control.
DIgnored
Incorrect
Ignoring removes the action from the calculation instead of crediting the control.
Identity Secure Score improvement actions can be marked Planned, Risk accepted, Resolved through third party or Resolved through alternate mitigation. The two Resolved statuses award the action's points because the control is covered elsewhere; Microsoft has no visibility into that implementation.
How long does Microsoft Entra ID keep sign-in and audit logs in a tenant with Microsoft Entra ID P1?
A7 days
B30 days
C90 days
DOne year
Show the answer and why
A7 days
Incorrect
Seven days is the Free retention.
B30 days
Correct
P1 and P2 keep audit and sign-in logs for 30 days.
C90 days
Incorrect
Neither P1 nor P2 keeps audit and sign-in logs for 90 days.
DOne year
Incorrect
Microsoft Entra ID doesn't keep these logs for a year with any license.
Audit and sign-in logs are kept for 7 days with Microsoft Entra ID Free and 30 days with P1 or P2. Microsoft Entra multifactor authentication usage data is kept for 30 days with every license.
For an investigation, an analyst must download about 180,000 audit log records and 180,000 sign-in records from the Microsoft Entra admin center. What should the analyst expect?
AEach log fits in a single downloaded file
BNeither fits, since a downloaded file holds at most 50,000 records
CThe audit records fit in one file; the sign-ins must be split
DThe sign-ins fit in one file; the audit records must be split
Show the answer and why
AEach log fits in a single downloaded file
Incorrect
A sign-in log file holds at most 100,000 records, fewer than the analyst needs.
BNeither fits, since a downloaded file holds at most 50,000 records
Incorrect
The limits are higher: 250,000 audit records or 100,000 sign-in records per file.
CThe audit records fit in one file; the sign-ins must be split
Correct
A file holds up to 250,000 audit records but only 100,000 sign-in records, so the sign-ins need narrower downloads.
DThe sign-ins fit in one file; the audit records must be split
Incorrect
It's the other way round: audit downloads allow more records per file than sign-in downloads.
The admin center downloads logs as CSV or JSON, with UTC timestamps. You can download up to 250,000 audit records or up to 100,000 sign-in or provisioning records per file, and larger downloads can time out, so a bigger set is split, for example by narrowing the date range.
A Conditional Access policy requires MFA for SharePoint Online, but a user says she wasn't prompted when she opened it this morning. In her sign-in log entry, which tab shows the methods she used, step by step, and whether the requirement was met by a claim already in her token?
ABasic info
BDevice info
CAuthentication Details
DConditional Access
Show the answer and why
ABasic info
Incorrect
Basic info holds the identifiers, status and failure reason, not the step-by-step methods.
BDevice info
Incorrect
Device info shows the browser, operating system and whether the device is compliant, managed or hybrid joined.
CAuthentication Details
Correct
It lists the methods used in sequence, the policies that required them and whether a requirement was satisfied by a token claim.
DConditional Access
Incorrect
This tab lists the policies and their result for the sign-in, not the sequence of methods.
The Authentication Details tab of a sign-in log entry shows the authentication policies applied, the sequence of methods used and whether each step succeeded and why, including requirements satisfied by claims in the token when the user wasn't prompted. The Conditional Access tab shows each policy's result (Success, Failure, Not Applied).
A user wasn't created in a SaaS app that Microsoft Entra ID provisions with SCIM. Which log shows what the provisioning service did for that user?
AThe provisioning logs
BThe sign-in logs
CThe Microsoft Graph activity logs
DThe Conditional Access insights workbook
Show the answer and why
AThe provisioning logs
Correct
Provisioning logs record each create, update and delete the service attempted, with its result.
BThe sign-in logs
Incorrect
Sign-in logs record authentication, not provisioning actions.
CThe Microsoft Graph activity logs
Incorrect
Those record Graph API requests, not provisioning steps.
DThe Conditional Access insights workbook
Incorrect
That workbook analyzes Conditional Access impact.
Microsoft Entra provisioning logs show the activities of the provisioning service, such as users and groups created, updated or deleted in target apps, with the status and the reason for failures.