How do you enable Sentinel UEBA and collect on-premises AD DS events?

Why the Answer Is Correct

The question has two requirements: turn on User and Entity Behavior Analytics for Sentinel1 and collect security events from the on-premises AD DS domain. Microsoft's documented method for syncing on-premises Active Directory identities into Sentinel UEBA is the Microsoft Defender for Identity data connector, which is fed by an MDI sensor installed on a domain controller. So the first action is to deploy Microsoft Defender for Identity to the AD DS domain (install the sensor on a DC), because until the sensor exists there is nothing for a connector to pull from. The second action is to configure the Microsoft Defender for Identity data connector for Sentinel1, which brings the identity entities and the AD-related security events into the workspace. The third action is to enable UEBA for Sentinel1, which activates the entity pages, behavior analytics and enrichments on top of the already-ingested identity data. That sensor → connector → enable-UEBA ordering is exactly what the community confirms, with danb67 stating "No point doing the connector before the sensor. Answer is correct."

Why Other Candidate Answers Are Wrong

Windows Event Forwarding plus the Windows Forwarded Events connector (the sequence Anarckii proposed, arguing "the question says nothing about defender") does satisfy the 'collect security events' half of the requirement, but it delivers log records only — it does not sync on-premises AD user accounts, groups and directory entities, which is the specific thing UEBA consumes. Placing the connector step before the sensor deployment, as Phil_79 wondered ("Shouldn't you deploy MDI before connecting it to Sentinel?"), creates a connector with no data source, so the ordering is inverted. Omitting the 'enable UEBA' action entirely, or enabling UEBA before any identity data exists, satisfies only one of the two stated requirements and leaves the workspace with empty entity pages. The remaining variants simply reorder the three required actions around the sensor prerequisite.

Community Comment Notes

mali1969 gives the clearest walkthrough: configure the Defender for Identity connector for Sentinel1, deploy Microsoft Defender for Identity to the AD DS domain, and install the MDI sensor on the domain controller to let UEBA collect on-premises security events. danb67, claiming to have deployed this repeatedly, insists on sensor before connector. user636 points at Microsoft's own 'How to enable user and entity behavior analytics' documentation and quotes the step about syncing user entities from on-premises Active Directory. ApexPredator84 confirms the scenario appeared in the exam on 21/12/2023, so expect the exact sensor-then-connector-then-UEBA phrasing rather than a WEF alternative.