Which Servers Can Send Windows Firewall Logs to Microsoft Sentinel?

AZ-801 By islever Editorial Last updated

Short answer

E VM1, VM2, and Server1 only

Question

You have an on-premises server named Server1 that runs Windows Server 2022 Standard. You have an Azure subscription that contains the virtual machines shown in the following table. The subscription contains a Microsoft Sentinel instance named Sentinel1 in the Central US Azure region. You need to implement the Windows Firewall connector. Which servers can send Windows Firewall logs to Sentinel1? - Exhibit: Which Servers Can Send Windows Firewall Logs to Microsoft Sentinel?
  1. VM1 only
  2. VM2 only
  3. VM1 and Server1 only
  4. VM1, VM2, and VM3 only
  5. VM1, VM2, and Server1 only Correct Answer

Key Takeaways

The exam tests your knowledge of the Windows Firewall connector’s OS support matrix: modern Windows Server versions and on-premises servers can be connected, while the older VM3 in the table is unsupported and is the intended distractor.

This AZ-801 question tests which Windows servers can use the Microsoft Sentinel Windows Firewall connector. Based on the connector's supported operating systems and Azure Monitor Agent prerequisites, the community-validated answer is E: VM1, VM2, and Server1 only.

Common mistake: Choosing D (VM1, VM2, and VM3 only) is the most common error because test-takers assume all Azure VMs in the subscription are automatically supported. However, VM3 runs a legacy Windows Server version that does not meet the Azure Monitor Agent or Windows Firewall connector minimum requirements.

Expert Analysis

Why the Answer Is Correct

The Windows Firewall connector for Microsoft Sentinel uses the Azure Monitor Agent (or legacy Log Analytics agent) to collect Windows Firewall events. VM1 (Windows Server 2022 Datacenter: Azure Edition) and VM2 (Windows Server 2019 Datacenter) are modern, supported operating systems, and Server1 is an on-premises Windows Server 2022 Standard machine that can also run the agent and connect to Sentinel1. Therefore these three can send logs. VM3 is excluded because it runs an older Windows Server version that is not supported by the connector.

Why the Other Options Are Wrong

Option A (VM1 only) omits VM2 and Server1, both of which are compatible. Option B (VM2 only) incorrectly omits VM1 and Server1. Option C (VM1 and Server1 only) omits VM2, which is a supported Azure VM. Option D (VM1, VM2, and VM3 only) includes VM3, but VM3 runs an unsupported legacy Windows Server version and therefore cannot send Windows Firewall logs. Option E is the only choice that includes all supported machines and excludes the unsupported VM3.

Community Comment Notes

One commenter with 5 likes pointed to the official documentation for the Log Analytics agent and Azure Monitor Agent supported operating systems, noting that support extends even to Windows Server 2012 R2, which helps clarify the boundary of the support matrix. Another highly rated comment (2 likes) explicitly explains that VM1, VM2, and Server1 are compatible with the Windows Firewall connector. A third comment asks "E or F?" because all four machines appear similar, but no F option was provided, reinforcing that E is the intended answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

In the exam, identify each machine's OS version and check the data connector's support matrix before choosing. Remember that the Windows Firewall connector is not limited to Azure VMs—on-premises Windows Servers can also be monitored by installing the agent and connecting to the Sentinel workspace.

Community Votes

E
100%

100% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. NicolaF 👍 5
    based on https://learn.microsoft.com/en-us/azure/sentinel/connect-services-windows-based#log-analytics-agent-legacy and https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-supported-operating-systems the connector is supported even on 2012R2
  2. kenda1535 👍 2 Answered E
    Azure Virtual Machines: VM1 (Windows Server 2022 Datacenter: Azure Edition) is fully compatible with the Windows Firewall connector due to its Azure-specific capabilities and integration with Azure services. VM2 (Windows Server 2019 Datacenter) is also compatible with the Windows Firewall connector, as it's a recent Windows Server version. On-premises Server: Server1 (Windows Server 2022 Standard) can also send Windows Firewall logs to Sentinel1 using the Windows Firewall Connector. This requires an agent to be installed on the on-premises server. VM3 Incompatibility: VM3 (Windows Server 2016 Datacenter) is not directly compatible with the Windows Firewall connector. While it's possible to use third-party solutions or custom scripts to extract and send firewall logs to Sentinel1, it's not a straightforward and officially supported method. Therefore, the correct answer is E. VM1, VM2, and Server1 only.
  3. BlackCat9588 👍 1 Answered E
    E or F?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to On-Prem VMs Forward Events to Azure Sentinel?

S-grade

What should you do first to implement JIT VM access for VM1?

S-grade

Which Groups Grant Least Privilege to Add a Windows Server 2022 DC?

S-grade

Where Can You Enable Microsoft Defender for Servers in Azure?

S-grade

← Back to AZ-801 Study Guide