Streaming Microsoft Graph activity logs to a third-party SIEM via Azure Event Hubs

Investigate Microsoft 365 activities to identify threats
Answer Correct answer: A — Azure Event Hubs is the streaming target for sending Microsoft Graph activity logs to a third-party SIEM.

You have an Azure subscription. You need to stream the Microsoft Graph activity logs to a third-party security information and event management (SIEM) tool. The solution must minimize administrative effort. To where should you stream the logs?

  1. an Azure Event Hubs namespace Correct Answer
  2. an Azure Storage account
  3. an Azure Event Grid namespace
  4. a Log Analytics workspace
microsoft graph activity logs event hubs siem streaming stream logs to siem

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Microsoft Graph activity logs can be exported to Azure Storage for retention or streamed via Azure Event Hubs to external SIEM tools; Event Hubs is the streaming target that feeds a third-party SIEM with the least integration effort.

To stream Microsoft Graph activity logs to a third-party SIEM with minimal effort, stream them to an Azure Event Hubs namespace, which is the documented export target for external SIEM integration.

Sending them to a Log Analytics workspace or Storage account — those are for analysis/retention inside Azure, not for streaming to an external third-party SIEM.

Community Discussion (3 comments)

DChilds 👍 7 Selected: A
A https://techcommunity.microsoft.com/t5/microsoft-entra-blog/microsoft-graph-activity-logs-is-now-generally-available/ba-p/4094535
talosDevbot 👍 2 Selected: A
"The logs are stored in Log Analytics for analysis, and you can export them to Azure Storage for long-term storage, or stream with Azure Event Hubs to external SIEM tools for alerting, analysis, or archival" https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview
laddu001 👍 2
Correct answer- an Azure Event Hubs namespace

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Graph activity logs are stored in Log Analytics for analysis and can be streamed with Azure Event Hubs to external SIEM tools for alerting and analysis. Event Hubs is the documented streaming export path to a third-party SIEM, satisfying the minimize-effort requirement.

Why the Other Options Are Wrong

A Storage account (B) is for long-term retention, not real-time SIEM streaming. A Log Analytics workspace (D) keeps the data inside Azure for queries, not for export to an external SIEM. An Event Grid namespace (C) is for event routing, not log streaming to SIEM.

Community Comment Notes

The community is unanimous (A 100). DChilds and talosDevbot cite the Microsoft Graph activity logs overview, which states the logs can be streamed with Azure Event Hubs to external SIEM tools.

Official Reference

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

Related Analysis

You have a Microsoft 365 E5 subscription. You need to config

A-Grade

You have an Azure subscription that contains a Microsoft Sen

A-Grade

You have an Azure subscription that uses Microsoft Defender

S-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide