Using Defender for Identity to mark a sensitive AD group and alert in Sentinel

SC-100 By islever Editorial Last updated

Design solutions for securing privileged access

Short answer

A Defender for Identity monitors AD DS, marks the group sensitive, and sends alerts to Sentinel via Defender XDR.

Question

Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment. You have a Microsoft 365 E5 subscription that uses Microsoft Defender. You have an Azure subscription that uses Microsoft Sentinel. You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort. What should you include in the recommendation?
  1. Microsoft Defender for Identity Correct Answer
  2. Microsoft Entra ID Protection
  3. Microsoft Entra Privileged Identity Management (PIM)
  4. Microsoft Defender for Office 365

Key Takeaways

Defender for Identity monitors on-premises AD DS, lets you designate sensitive groups such as Org Management, and integrates with Sentinel for alerts; PIM and Entra ID Protection do not cover on-prem AD DS group changes.

To mark an on-premises AD DS group (Organization Management) as sensitive and raise a Sentinel alert on changes with minimal effort, use Microsoft Defender for Identity, which monitors AD DS, flags sensitive groups, and feeds signals to Defender XDR/Sentinel.

Common mistake: Choosing PIM (C) — PIM governs Entra ID role eligibility, not on-premises AD DS group membership changes, which is what Defender for Identity monitors.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Identity monitors on-premises Active Directory, can mark high-privilege groups such as Exchange Organization Management as sensitive, and surfaces alerts that flow into Microsoft Defender XDR and Microsoft Sentinel, meeting the requirement with minimal effort.

Why the Other Options Are Wrong

Microsoft Entra PIM (C) and Entra ID Protection (B) operate on Entra ID, not on on-premises AD DS group membership. Defender for Office 365 (D) protects email, not AD DS group changes. Therefore Defender for Identity (A) is the only option that covers on-prem AD DS sensitive-group monitoring and Sentinel alerting.

Community Comment Notes

The community favored A (80 votes). Comments note that the Exchange hybrid means the Org Management group is synced from on-prem and must be protected by Defender for Identity; a minority (C, 20 votes) suggested PIM, which does not cover on-prem AD DS.

Official Reference

https://learn.microsoft.com/en-us/defender-for-identity/what-is

This link opens the official vendor documentation in a new tab.

Community Votes

A
80%
C
20%

80% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. jim85 👍 1 Answered A
    Microsoft Defender for Identity is a cloud-based security solution that helps secure your identity monitoring across your organization. Defender for Identity is fully integrated with Microsoft Defender XDR, and leverages signals from both on-premises Active Directory and cloud identities to help you better identify, detect, and investigate advanced threats directed at your organization.
  2. oscarpopi 👍 1 Answered A
    MDI is the correct answer, Exchange Hybrid, means OM group is being synced from the on-prem. and it needs to be protected .
  3. Ali96 👍 1 Answered C
    C. Microsoft Entra Privileged Identity Management (PIM)
  4. 676ae1a 👍 2 Answered A
    Respuesta correcta

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide