Analyzing all Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs table

SC-200 By islever Editorial Last updated

Investigate Microsoft 365 activities to identify threats

Short answer

E The MicrosoftGraphActivityLogs table records all Microsoft Graph API activity, so all listed tactics are analyzable there.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table. You need to search for malicious activities in your organization. Which tactics can you analyze by using the MicrosoftGraphActivityLogs table? - Exhibit: Analyzing all Microsoft Graph API attack tactics through the
  1. Tactic1 only
  2. Tactic2 only
  3. Tactic1 and Tactic3 only
  4. Tactic2 and Tactic3 only
  5. Tactic1, Tactic2, and Tactic3 Correct Answer

Key Takeaways

The MicrosoftGraphActivityLogs table captures all Microsoft Graph API activity across the tenant; any tactic carried out through Graph API calls (not just one or two) is visible in that table.

When an attacker uses the Microsoft Graph API as a vector, every tactic expressed as a Graph API call is recorded in the MicrosoftGraphActivityLogs advanced-hunting table, so all listed tactics are analyzable there.

Common mistake: Excluding a tactic such as VM deletion on the assumption it is only an ARM operation — the exam treats all listed tactics as Graph-API-analyzable, so all are covered by the table.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR advanced hunting provides the MicrosoftGraphActivityLogs table, which records Microsoft Graph API activity in the tenant. Any attacker tactic executed through the Graph API is captured there, so all listed tactics that are expressed as Graph calls can be analyzed using this table.

Why the Other Options Are Wrong

Selecting only a subset (A, B, C, D) undercounts the coverage; the table logs all Graph API activity, so all tactics performed via Graph are analyzable.

Community Comment Notes

The community favors E (all three, 100 votes). While g_man_rap and user636 note that VM deletion could be an ARM/AzureActivity operation, the exam framing treats all three tactics as Graph-API-analyzable, and Optimizor_IT and 90158a0 confirm E.

Official Reference

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

This link opens the official vendor documentation in a new tab.

Community Votes

E
100%

100% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. g_man_rap 👍 3
    is options are incorrect: Tactic3: Deletes Azure virtual machines Deleting Azure virtual machines is more of an Azure Resource Manager (ARM) operation rather than a Microsoft 365 or Microsoft Graph API-specific action. This would typically be logged in Azure Activity Logs, not the MicrosoftGraphActivityLogs.
  2. user636 👍 2
    Another vague question. Answer is Tactic1 & Tactic2. But as there is no such option in the answers, go for "E".
  3. 90158a0 👍 1
    From ChatGPT: Tactic1: Discovers misconfigured mailboxes - This would involve API calls to access mailbox settings and configurations, which would be logged in the MicrosoftGraphActivityLogs table. Tactic2: Searches Microsoft Teams chats and exports full conversations - This involves accessing Microsoft Teams data through API calls, which would also be logged in the MicrosoftGraphActivityLogs table. Tactic3: Deletes Azure virtual machines - This is an action related to Azure Resource Management, which might not be directly logged in the MicrosoftGraphActivityLogs table. This activity is more likely to be found in Azure activity logs. Why there is no option 1 and 2?
  4. Optimizor_IT 👍 1 Answered E
    E. Tactic 1, Tactic 2, and Tactic 3 (with caveat): Why: Tactic 1 and Tactic 2 are definitively in MicrosoftGraphActivityLogs. Tactic 3 (VM deletion) isn’t typically Graph API, but if the attacker used Graph API for related Azure enumeration (e.g., /organization), it might be partially traceable. However, deletion itself is in AzureActivity. E assumes all tactics use Graph API, though Tactic 3 stretches this—likely a question intent vs. technical mismatch.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide