Identifying Affected Entities in Microsoft Defender XDR Incidents

SC-200 By islever Editorial Last updated

Short answer

B Use the Assets tab in the Microsoft Defender portal to view a unified list of all affected devices, users, mailboxes, and apps involved in the incident.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR.
You need to identify all the entities affected by an incident.
Which tab should you use in the Microsoft Defender portal?
  1. Investigations
  2. Assets Correct Answer
  3. Evidence and Response
  4. Alerts

Key Takeaways

The trap is choosing Evidence and Response for granular details; however, the Assets tab provides the necessary unified roll-up of all affected high-level entities (users, devices, etc.).

Learn how to identify all entities affected by an incident using the Assets tab in Microsoft Defender XDR. This guide clarifies why Assets is preferred over Evidence and Response for comprehensive entity visibility.

Common mistake: Choosing C (Evidence and Response). This tab shows technical artifacts and response actions but lacks the consolidated view of impacted identities and devices provided by the Assets tab.

Expert Analysis

To identify all entities affected by an incident in Microsoft Defender XDR, you must use the Assets tab. The question specifically asks for the identification of affected entities within the context of an incident investigation.

In the Microsoft Defender portal, when viewing an incident, there are several tabs available: Alerts, Evidence and Response, Entities, and Assets. While the Evidence and Response tab provides detailed technical artifacts (files, processes, IPs) and response actions, it does not provide a consolidated view of all impacted high-level entities like users, devices, mailboxes, and apps. Similarly, the Entities tab focuses on specific technical indicators rather than the broader asset inventory.

The Assets tab is designed to give a unified view of all assets involved in or affected by the incident. It breaks down the impact across different categories such as Devices, Users, Mailboxes, and Apps. This allows security analysts to quickly assess the scope of the incident by seeing which specific user accounts, endpoints, or cloud applications have been compromised or interacted with maliciously. Therefore, for identifying 'all' affected entities in a comprehensive manner, the Assets tab is the correct choice.

Comments often confuse this with the Evidence and Response tab because that tab contains granular data. However, the distinction lies in the level of abstraction: Assets gives the holistic view of impacted identity and device objects, which is typically what is meant by 'entities affected' in terms of scope assessment.

Official Reference

https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about 'identifying affected entities' or 'scope' in Defender XDR, look for the tab that consolidates high-level asset types. Distinguish between granular technical evidence (Evidence and Response) and the unified asset inventory (Assets). Memorize that Assets covers Devices, Users, Mailboxes, and Apps collectively.

Community Votes

C
44%
B
31%
D
25%

44% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 22 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 22

  1. user636 👍 7 Answered C
    Evidence and Response: This tab provides detailed information about "all" the evidence related to an incident.
  2. Another_one 👍 6 Answered B
    Correct me if I wrong, but should answer be B. Assets ? https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents#alerts Easily view and manage all your assets in one place with the new Assets tab. This unified view includes Devices, Users, Mailboxes and Apps. The Assets tab displays the total number of assets beside its name. A list of different categories with the number of assets within that category is presented when selecting the Assets tab. All assets affected at one place.
  3. g_man_rap 👍 4 Answered C
    Evidence and Response: This tab provides detailed information about all the evidence related to an incident. This includes the entities (such as files, devices, users, IP addresses, etc.) that are involved or impacted by the incident. The tab allows you to see how these entities are related to the threat and what actions have been taken or need to be taken. This is the most appropriate place to view all affected entities within an incident.
  4. 90158a0 👍 4 Answered C
    Evidence and Response: This tab provides a detailed view of all the evidence collected during the investigation, including affected entities such as files, processes, users, and devices. It also shows the response actions taken for the incident.
  5. Itsmebigal 👍 3 Answered B
    I would say Alerts -> Assets tab which would show you something like this Devices (10) Users (0) Mailboxes (0) Apps (1) Cloud Resources (0)
Show 17 more comments
  1. HAjouz 👍 3 Answered C
    However, the "Evidence and Response" tab, specifically within an incident's context, provides that deeper dive into the affected entities.
  2. Studytime2023 👍 3 Answered D
    This proves it's D https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents#alerts
  3. scfitzp 👍 2
    I vote D, the key here being "identify ALL the entities" https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents Alerts On the Alerts tab, you can view the alert queue for alerts related to the incident and other information about them such as: Severity. The entities that were involved in the alert. The source of the alerts (Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Defender for Cloud Apps, and the app governance add-on). The reason they were linked together.
  4. Djonzi 👍 2 Answered B
    Evidence & response lists the evidence objects (files, processes, IPs, URLs, mail items) and any response actions taken. The tab that shows a roll‑up of all affected entities (devices, users/identities, mailboxes, apps, etc.) .
  5. Itsmebigal 👍 2
    Kind of a crap question because you would really use both. Assets for Devices, Users, Mailbox, etc and Evidence and Response for IPs, Processes, Files, etc.
  6. Krayzr 👍 2
    Its asking for "ENTITIES" not "asstes" https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents#evidence-and-response
  7. sapphire 👍 2 Answered C
    I work with MS Defender XDR and all entities are in Evidence and Response. Correct answer.
  8. Onimole 👍 2 Answered B
    assets. i use it every timeeeeeeeeeeee
  9. OneplusOne 👍 1 Answered B
    The Impacted Assets column in the Incidents list gives a clear overview of affected entities, and the Assets pane breaks this down further, showing items like devices and user accounts involved in an incident. Meanwhile, the Entities tab under Evidence and Response focuses more on technical artifacts such as files, processes, and services, but it doesn’t include all impacted assets like user accounts. This distinction is crucial when investigating incidents, as security teams need both perspectives—technical details from the Entities tab and broader context from the Assets pane.
  10. talosDevbot 👍 1 Answered D
    I'll go with D) Alerts Important part of the question is identifying all the entities AFFECTED by an incident. The Assets and Evidence & Response tabs show entities that are part of or related to the incident, not necessarily affected. Alerts tab will show you "events of the alert, which other triggered alerts caused the current alert, and all the affected entities and activities involved in the attack, including devices, files, users, and mailboxes". The table in the Alerts tab also has a column for Impacted entities
  11. Adel614 👍 1 Answered C
    C. Evidence and Response Considering that affected entities could include unmanaged ones by "Assets" like IP addresses, the correct tab to use in the Microsoft Defender portal to identify all entities affected by an incident would likely be Evidence and Response (C). This tab provides broader insight into the evidence collected during the investigation, which includes both managed and unmanaged entities, such as IP addresses, files, or processes.
  12. cbdfbaf 👍 1 Answered D
    D. Alerts - 'All entities affected by an incident': Under the 'alerts' section: 'You can see the events of the alert, which other triggered alerts caused the current alert, and all the affected entities and activities involved in the attack, including devices, files, users, cloud apps, and mailboxes.' https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents#evidence-and-response
  13. Optimizor_IT 👍 1 Answered C
    Displays a complete list (e.g., devices, users, files, IPs, mailboxes) tied to the incident’s alerts and evidence.
  14. Krayzr 👍 1
    https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents#assets
  15. Hawklx 👍 1 Answered D
    Alert is better to identifying all the entities affected by an incident
  16. rebecchu0731 👍 1
    I asked Copilot and answer is Assets
  17. VeiN 👍 1
    Same as Q31 Topic 1

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide