Which KQL Table and Status Code Show Unauthorized Requests?

Detect threats by using the Microsoft Sentinel platform

Answer Use the MicrosoftGraphActivityLogs table and filter where ResponseStatusCode equals 401 (Unauthorized) to return the failed Graph requests.

HOTSPOT You have an Azure subscription that contains a Log Analytics workspace named Workspace1. You configure Azure activity logs and Microsoft Entra ID logs to be forwarded to Workspace1. You need to query Workspace1 to identify all the requests that failed due to insufficient authorization. How should you complete the KQL query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. exhibit

Community Insight

The exam tests choosing the log table that exposes HTTP response codes and mapping the failed-authorization scenario to ResponseStatusCode 401, with the trap being AzureActivity, which does not contain that column.

This SC-200 hotspot asks you to complete a KQL query in a Log Analytics workspace to find failed Microsoft Graph requests. The correct table is MicrosoftGraphActivityLogs, and the status code to filter is 401 for unauthorized requests.

Selecting AzureActivity because Azure activity logs were forwarded, even though that table lacks ResponseStatusCode, or confusing 403 Forbidden with the intended 401 Unauthorized status.

Community Discussion (15 comments)

belyo 👍 1

AzureActivity and 401 Microsoft Graph Activity Logs provide details of API requests made to Microsoft Graph for resources in the tenant. workspace1 is not accessed trough graph, we have no business with MicrosoftGraphActivityLogs

KAMOMILED 👍 2

13 Sep 2025 TEST

f90c339 👍 5

MicrosoftGraphActivityLogs and 401. The AzureActivity table doesn't have the column ResponseStatusCode, and MicrosoftGraphActivityLogs does: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/MicrosoftGraphActivityLogs

Optimizor_IT 👍 1

Both of the answers are wrong: 403 OR 403 makes no sense. It should be 401 - Unauthorized. The first field is AzureActivity.

BtwIdonno 👍 4

MicrosoftGraphActivityLogs 401 https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/microsoftgraphactivitylogs - microsoftgraphactivitylogs has the field "ResponseStatusCode" 401- unauthorized

LinearB 👍 3

401... What is the difference between ResponseStatusCodes 401, 402, and 403? Here's a brief overview of the differences between HTTP status codes 401, 402, and 403: 401 Unauthorized: This status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. It means the client needs to authenticate itself to get the requested response. 402 Payment Required: This status code is reserved for future use and is not currently used in practice. It was intended to indicate that the requested resource is only available for a fee. 403 Forbidden: This status code indicates that the server understood the client's request, but is refusing to fulfill it. Unlike 401, this status code does not imply that the client can make the request again with proper authentication; it means access is forbidden for the client.

xRiot007 👍 1

403 does make sense - https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#client_error_responses (401 actually means not authenticated and thus restricted by default)

Tuitor01 👍 3

403 makes absolutely no sense here, 401 must be the correct choice sine http respond code 401 means basically wrong password and 403 means forbidden. 402 is not even used (reserved ) example query = MicrosoftGraphActivityLogs | where TimeGenerated >= ago(3d) | where ResponseStatusCode == 401 or ResponseStatusCode == 403 | where RequestUri contains "/groups" | summarize UniqueRequests=count_distinct(RequestId) by AppId, ServicePrincipalId, UserId | sort by UniqueRequests desc | limit 20 From https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

sapphire 👍 6

explain in - https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview Microsoft Graph activity logs and 403

sapphire 👍 11

sorry Microsoft Graph activity logs and 401 are correct answers

0854338 👍 3

I wonder what is the logic of this query answer: Why would one use a redundant condition of where xxx = 403 OR xxx = 403 ? This comment is posted on 10/11/2024 when the shown greenbox for answer 1 is AuditLogs and answer 2 is 403.

Mobollz 👍 9

AzureActivity and 401 https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-administration-management/http-status-code

Sparkletoss 👍 1

I will take activity log and 403 due to insufficient permission. I may be wrong though will be glad if this question can get more discussions on time

Sparkletoss 👍 1

I will take Azureactivity and 403 due to insufficient permission. I may be wrong though will be glad if this question can get more discussions on time

chirva 👍 1

GPT4: AzureActivity | where ResponseStatusCode == "401" or ResponseStatusCode == "403" 401 Unauthorized: This status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. 403 Forbidden: This status code indicates that the server understood the request but refuses to authorize it. This is typically the status code that indicates insufficient permissions.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The KQL query must read from MicrosoftGraphActivityLogs because that table stores Microsoft Graph API request records, including the ResponseStatusCode column used to filter failures. The scenario asks for requests rejected due to insufficient authorization, and in the Graph activity log context the exam targets ResponseStatusCode == 401 (Unauthorized). This combination lets Workspace1 surface the failed Graph calls without needing to join AzureActivity or AuditLogs. As sapphire noted, “Microsoft Graph activity logs and 401 are correct answers,” and f90c339 added that AzureActivity has no ResponseStatusCode.

Why Other Candidate Answers Are Wrong

AzureActivity is tempting because Azure activity logs are forwarded, but it records control-plane operations and does not expose a ResponseStatusCode field for Graph API replies. AuditLogs tracks directory changes rather than per-request HTTP outcomes, so it cannot isolate 401 failures. Choosing 403 Forbidden or 402 is also off-target for this hotspot: 402 is reserved, and the scenario’s unauthorized-request wording maps to 401 in the Graph activity logs. Commenters such as Tuitor01 stressed that 401 is the code to use, while BtwIdonno pointed to the table reference confirming ResponseStatusCode in MicrosoftGraphActivityLogs.

Community Comment Notes

The thread shows a split early on: some learners suggested AzureActivity and 401, but sapphire corrected that to Microsoft Graph activity logs and 401. f90c339’s explanation is the most useful technical check because it notes “The AzureActivity table doesn't have the column ResponseStatusCode.” Several others, including BtwIdonno and Tuitor01, reinforced the MicrosoftGraphActivityLogs plus 401 combination, while a minority argued for 403. The consensus that matters here is the schema evidence, not the vote count.

Official Reference

Exam Strategy

First identify which table has the ResponseStatusCode column; only MicrosoftGraphActivityLogs fits this hotspot. Then map the failure description to the status-code dropdown—do not pick AzureActivity just because activity logs are mentioned in the scenario.

Frequently Asked Questions

Why is AzureActivity not the table for this SC-200 KQL hotspot?

AzureActivity records Azure control-plane operations and lacks ResponseStatusCode; MicrosoftGraphActivityLogs stores Graph API HTTP status codes, so it is the correct table.

Does insufficient authorization mean 401 or 403 in MicrosoftGraphActivityLogs?

This hotspot targets 401 Unauthorized, which Graph activity logs capture for requests rejected as unauthorized; 403 Forbidden represents a separate permissions condition.

More SC-200 FAQ →

Related Analysis

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide