Escalating Alerts in Azure Sentinel via Incident Assignment

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender for Endpoint Investigate Microsoft 365 activities to identify threats

Short answer

D Assign the incident to delegate ownership and notify the administrator responsible for further investigation.

Question

You are investigating an incident in Azure Sentinel that contains more than 127 alerts.
You discover eight alerts in the incident that require further investigation.
You need to escalate the alerts to another Azure Sentinel administrator.
What should you do to provide the alerts to the administrator?
  1. Create a Microsoft incident creation rule
  2. Share the incident URL
  3. Create a scheduled query rule
  4. Assign the incident Correct Answer

Key Takeaways

Assignment is the primary method for delegating incident ownership and triggering notifications; sharing URLs is a manual workaround that lacks workflow integration.

Learn how to properly escalate specific alerts within an Azure Sentinel incident by assigning the incident to another administrator for focused investigation.

Common mistake: Sharing the incident URL (B) is often chosen because it seems simpler, but it fails to formally transfer ownership or alert the new administrator through system mechanisms.

Expert Analysis

The core of this question lies in understanding the workflow mechanics of Microsoft Sentinel incident management. When an analyst identifies specific alerts within a large incident that require further attention or escalation to a peer, the standard operational procedure is to assign the incident to that user. This action formally delegates ownership and ensures the recipient receives notifications (via email or Teams) regarding the new assignment.

While sharing the URL (Option B) provides access, it does not create a formal handoff, track ownership, or trigger workflow automations associated with assignment. Option A (Creation rules) and Option C (Scheduled query rules) are related to detection logic, not incident response workflows. The comments reflect a common debate: some users argue for sharing links to keep the original owner involved, but exam doctrine prioritizes 'assignment' as the mechanism for escalating responsibility and ensuring accountability in the SIEM platform.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases

This link opens the official vendor documentation in a new tab.

Exam Strategy

When faced with questions about 'escalation', 'handoff', or 'delegating responsibility' in Microsoft Sentinel, look for 'Assign' as the correct action. Avoid options like 'Share URL' unless the scenario explicitly states that no role change or notification is desired, as assignment is the built-in tool for managing workload distribution among analysts.

Frequently Asked Questions

Why is sharing the URL not the best answer?

Sharing a URL is a passive action that doesn't notify the other administrator or update the incident's ownership status, which can lead to tracking issues.

Can I assign multiple incidents at once?

Yes, you can select multiple incidents in the incident list view and use the 'Assign' action to delegate them to one or more administrators simultaneously.

More SC-200 FAQ →

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. Eltooth 👍 7
    Correct - D
  2. amsioso 👍 3
    D Incidents can be assigned to a specific user or to a group. For each incident you can assign an owner, by setting the Owner field. All incidents start as unassigned. You can also add comments so that other analysts will be able to understand what you investigated and what your concerns are around the incident.
  3. JoeP1 👍 3 Answered D
    D - Assign the incident is the best option, but you can also tag or bookmark the alerts that need further investigation.
  4. ACSC 👍 3 Answered D
    https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases#how-to-investigate-incidents
  5. xRiot007 👍 3 Answered D
    Escalation to another person is done by assigning that incident to the respective person
Show 10 more comments
  1. antoniokt 👍 3 Answered D
    D is good
  2. talosDevbot 👍 2
    question is asking "to escalate the alerts to another Azure Sentinel administrator"
  3. Kamal_SriLanka 👍 2
    D is correct
  4. Anonymous learner 👍 1 Answered B
    should share the incident URL. This will allow the administrator to access the incident and review the relevant alerts without needing to sift through the entire incident. Assigning the incident or creating a scheduled query rule would not be useful for this scenario, as they would not provide a focused view of the specific alerts that require further investigation.
  5. HAjouz 👍 1 Answered B
    sorry but I dont think so. if you assign the incident you don't have ownership of it anymore - you just need to delegate the alerts to someone else - hence sharing URL and asking them to investigate the alerts not pass on all the incident to them
  6. Anarckii 👍 1 Answered B
    "to provide the alerts to the administrator" not assign. You would share the link. Have done this multiple of times working on an Incident Response team
  7. Onimole 👍 1
    maginging sharing 8 links :D What if it was 25 incidents, would you share 25 links too?
  8. billo79152718 👍 1
    Well then he/she should not have the Azure Sentinel Administrator role delegated. :-D
  9. Fukacz 👍 1
    You should also let him know and share URL
  10. chepeerick 👍 1
    Correct option

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide