Streaming Microsoft Graph activity logs to a third-party SIEM via Azure Event Hubs

SC-200 By islever Editorial Last updated

Investigate Microsoft 365 activities to identify threats

Short answer

A Azure Event Hubs is the streaming target for sending Microsoft Graph activity logs to a third-party SIEM.

Question

You have an Azure subscription. You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort. To where should you stream the logs?
  1. an Azure Event Hubs namespace Correct Answer
  2. an Azure Storage account
  3. an Azure Event Grid namespace
  4. a Log Analytics workspace

Key Takeaways

Microsoft Graph activity logs can be exported to Azure Storage for retention or streamed via Azure Event Hubs to external SIEM tools; Event Hubs is the streaming target that feeds a third-party SIEM with the least integration effort.

To stream Microsoft Graph activity logs to a third-party SIEM with minimal effort, stream them to an Azure Event Hubs namespace, which is the documented export target for external SIEM integration.

Common mistake: Sending them to a Log Analytics workspace or Storage account — those are for analysis/retention inside Azure, not for streaming to an external third-party SIEM.

Expert Analysis

Why the Answer Is Correct

Microsoft Graph activity logs are stored in Log Analytics for analysis and can be streamed with Azure Event Hubs to external SIEM tools for alerting and analysis. Event Hubs is the documented streaming export path to a third-party SIEM, satisfying the minimize-effort requirement.

Why the Other Options Are Wrong

A Storage account (B) is for long-term retention, not real-time SIEM streaming. A Log Analytics workspace (D) keeps the data inside Azure for queries, not for export to an external SIEM. An Event Grid namespace (C) is for event routing, not log streaming to SIEM.

Community Comment Notes

The community is unanimous (A 100). DChilds and talosDevbot cite the Microsoft Graph activity logs overview, which states the logs can be streamed with Azure Event Hubs to external SIEM tools.

Official Reference

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

This link opens the official vendor documentation in a new tab.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. DChilds 👍 7 Answered A
    A https://techcommunity.microsoft.com/t5/microsoft-entra-blog/microsoft-graph-activity-logs-is-now-generally-available/ba-p/4094535
  2. talosDevbot 👍 2 Answered A
    "The logs are stored in Log Analytics for analysis, and you can export them to Azure Storage for long-term storage, or stream with Azure Event Hubs to external SIEM tools for alerting, analysis, or archival" https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview
  3. laddu001 👍 2
    Correct answer- an Azure Event Hubs namespace

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide