Microsoft Defender for Identity Honeytoken Configuration

SC-200 By islever Editorial Last updated

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Short answer

B No, configuring the sign-in risk policy in Azure AD Identity Protection does not meet the goal of setting up MDI honeytoken accounts.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might
meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Microsoft Defender for Identity integration with Active Directory.
From the Microsoft Defender for identity portal, you need to configure several accounts for attackers to exploit.
Solution: From Azure AD Identity Protection, you configure the sign-in risk policy.
Does this meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The main trap is confusing MDI's honeytoken entity configuration with Entra ID's sign-in risk policies, which serve different security functions.

This SC-200 question tests knowledge of Microsoft Defender for Identity honeytoken setup versus Azure AD Identity Protection policies.

Common mistake: Candidates often select 'Yes' because both tools involve identity protection, but they fail to recognize that MDI honeytokens require specific entity tagging within the MDI portal, not Azure AD policies.

Expert Analysis

Scenario Analysis The question asks how to configure accounts in Microsoft Defender for Identity (MDI) that are designed for attackers to exploit. This is the specific definition of Honeytoken entities. Honeytokens are decoy accounts or devices with no legitimate business purpose; any authentication attempt, file access, or query involving them is inherently suspicious and triggers a security alert.

Evaluation of the Proposed Solution The proposed solution suggests configuring the "sign-in risk policy" within Azure AD Identity Protection (now Microsoft Entra ID Protection). This is incorrect because:

  1. Different Products: Azure AD Identity Protection is an identity governance and risk management tool focused on cloud identities and conditional access policies. It does not manage the internal configuration of MDI honeytokens.
  2. Wrong Mechanism: A sign-in risk policy evaluates risk scores based on user behavior and location to trigger step-up authentication or block access. It does not create or manage the trap accounts required by MDI to detect lateral movement or credential theft against Active Directory.

Correct Approach To achieve the goal, one must navigate to the Microsoft Defender for Identity portal, go to Settings > Identities, and use the Entity tags section to add Users or Devices as Honey Tokens. This directly aligns with the requirement to set up traps for attackers within the MDI ecosystem.

Conclusion The proposed solution fails to address the specific mechanism (MDI Honeytokens) and incorrectly substitutes it with a different product's feature (Entra ID Risk Policies). Therefore, the solution does not meet the goal.

Exam Strategy

When a question specifies a particular Microsoft security product (like Defender for Identity), always verify if the proposed solution uses features native to that product. Do not assume that similar-sounding features in other products (like Entra ID Protection) can substitute for missing functionality. Read the verbs carefully: 'configure accounts' implies creating entities, whereas 'risk policy' implies evaluating existing ones.

Frequently Asked Questions

What are Honeytoken entities in Microsoft Defender for Identity?

Honeytokens are decoy accounts or devices with no legitimate use. Any activity involving them triggers an alert, helping detect attacker movement.

Where do I configure Honeytokens in the MDI portal?

Navigate to Settings > Identities > Entity tags > Honey Token to add Users or Devices as traps for malicious actors.

Can I use Azure AD Identity Protection to create MDI honeytokens?

No. Azure AD Identity Protection manages cloud identity risks and conditional access, while MDI honeytokens are configured specifically within the Defender for Identity platform.

More SC-200 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Metasploit 👍 12 Answered B
    Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert. Settings>Identities>Entity tags>Honey Token> Add Users or Devices
  2. Task 👍 7
    Correct
  3. Tx4free 👍 4 Answered B
    Correct answer
  4. d33ccca 👍 3 Answered B
    On exam, December 2025
  5. da77986 👍 2 Answered B
    In the exam 05-2025
Show 4 more comments
  1. Nikki0222 👍 2
    No, correct
  2. DuzBro 👍 1 Answered B
    The goal is to configure accounts for attackers to exploit. That describes honeytoken accounts in Microsoft Defender for Identity: decoy accounts with no legitimate use, so any activity involving them (sign-in attempts, queries, etc.) raises an alert. The proposed solution is configuring the sign-in risk policy in Azure AD (Microsoft Entra) Identity Protection. That is a different feature. It evaluates how risky a sign-in looks (unfamiliar location, anonymous IP, and so on) and can require MFA or block access. It does not create decoy accounts. The correct approach In the Defender for Identity portal (security.microsoft.com), you: Go to Settings > Identities (or the Defender for Identity settings). Open Entity tags. Select Honeytoken. Tag the accounts you want to use as decoys. Defender for Identity then alerts when a honeytoken account is used or probed.
  3. ramzicpg 👍 1 Answered B
    Explication : - Microsoft Defender for Identity permet de surveiller Active Directory et de détecter les activités suspectes, notamment grâce aux comptes leurres (Honeytoken). - Microsoft Entra ID Protection (anciennement Azure AD Identity Protection) sert à détecter et gérer les risques liés aux identités et aux connexions, notamment avec les stratégies de risque de connexion. La stratégie de risque de connexion ne permet pas de configurer des comptes Honeytoken dans Active Directory. les comptes leurres se configurent via les tags d’entité dans Microsoft Defender for Identity, pas via une stratégie de risque de connexion.
  4. chepeerick 👍 1
    no, this is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide