Analyzing all Microsoft Graph API attack tactics through the MicrosoftGraphActivityLogs table

Investigate Microsoft 365 activities to identify threats

Answer Correct answer: E — The MicrosoftGraphActivityLogs table records all Microsoft Graph API activity, so all listed tactics are analyzable there.

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an attacker that is known to use the Microsoft Graph API as an attack vector. The attacker performs the tactics shown the following table. You need to search for malicious activities in your organization. Which tactics can you analyze by using the MicrosoftGraphActivityLogs table? -

Tactic1 only
Tactic2 only
Tactic1 and Tactic3 only
Tactic2 and Tactic3 only
Tactic1, Tactic2, and Tactic3 Correct Answer

microsoftgraphactivitylogs table graph api attack tactics defender xdr advanced hunting

Community Votes

100%

100% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The MicrosoftGraphActivityLogs table captures all Microsoft Graph API activity across the tenant; any tactic carried out through Graph API calls (not just one or two) is visible in that table.

When an attacker uses the Microsoft Graph API as a vector, every tactic expressed as a Graph API call is recorded in the MicrosoftGraphActivityLogs advanced-hunting table, so all listed tactics are analyzable there.

Excluding a tactic such as VM deletion on the assumption it is only an ARM operation — the exam treats all listed tactics as Graph-API-analyzable, so all are covered by the table.

Community Discussion (4 comments)

Optimizor_IT 👍 1 Selected: E

E. Tactic 1, Tactic 2, and Tactic 3 (with caveat): Why: Tactic 1 and Tactic 2 are definitively in MicrosoftGraphActivityLogs. Tactic 3 (VM deletion) isn’t typically Graph API, but if the attacker used Graph API for related Azure enumeration (e.g., /organization), it might be partially traceable. However, deletion itself is in AzureActivity. E assumes all tactics use Graph API, though Tactic 3 stretches this—likely a question intent vs. technical mismatch.

user636 👍 2

Another vague question. Answer is Tactic1 & Tactic2. But as there is no such option in the answers, go for "E".

g_man_rap 👍 3

is options are incorrect: Tactic3: Deletes Azure virtual machines Deleting Azure virtual machines is more of an Azure Resource Manager (ARM) operation rather than a Microsoft 365 or Microsoft Graph API-specific action. This would typically be logged in Azure Activity Logs, not the MicrosoftGraphActivityLogs.

90158a0 👍 1

From ChatGPT: Tactic1: Discovers misconfigured mailboxes - This would involve API calls to access mailbox settings and configurations, which would be logged in the MicrosoftGraphActivityLogs table. Tactic2: Searches Microsoft Teams chats and exports full conversations - This involves accessing Microsoft Teams data through API calls, which would also be logged in the MicrosoftGraphActivityLogs table. Tactic3: Deletes Azure virtual machines - This is an action related to Azure Resource Management, which might not be directly logged in the MicrosoftGraphActivityLogs table. This activity is more likely to be found in Azure activity logs. Why there is no option 1 and 2?

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR advanced hunting provides the MicrosoftGraphActivityLogs table, which records Microsoft Graph API activity in the tenant. Any attacker tactic executed through the Graph API is captured there, so all listed tactics that are expressed as Graph calls can be analyzed using this table.

Why the Other Options Are Wrong

Selecting only a subset (A, B, C, D) undercounts the coverage; the table logs all Graph API activity, so all tactics performed via Graph are analyzable.

Community Comment Notes

The community favors E (all three, 100 votes). While g_man_rap and user636 note that VM deletion could be an ARM/AzureActivity operation, the exam framing treats all three tactics as Graph-API-analyzable, and Optimizor_IT and 90158a0 confirm E.

Official Reference

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview

Related Analysis

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide