Querying IdentityLogonEvents to hunt LDAP simple binds to AD DS domain controllers

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

D IdentityLogonEvents records on-premises AD authentication, including LDAP simple binds to domain controllers.

Question

Your on-premises network contains an Active Directory Domain Services (AD DS) forest. You have a Microsoft Entra tenant that uses Microsoft Defender for Identity. The AD DS forest syncs with the tenant. You need to create a hunting query that will identify LDAP simple binds to the AD DS domain controllers. Which table should you query?
  1. AADServicePrincipalRiskEvents
  2. AADDomainServicesAccountLogon
  3. SigninLogs
  4. IdentityLogonEvents Correct Answer

Key Takeaways

IdentityLogonEvents is the advanced-hunting table that records on-premises AD authentication (including LDAP binds), whereas SigninLogs and the Entra tables cover Azure AD/Entra sign-ins, not on-prem AD DC binds.

To hunt LDAP simple binds to on-premises Active Directory Domain Services domain controllers in Defender for Identity advanced hunting, query the IdentityLogonEvents table, which holds authentication activities made through on-premises Active Directory.

Common mistake: Using SigninLogs or AADDomainServicesAccountLogon — those cover Entra/Azure AD authentication, not the on-premises AD DS LDAP simple binds captured by IdentityLogonEvents.

Expert Analysis

Why the Answer Is Correct

The IdentityLogonEvents table in Microsoft Defender for Identity advanced hunting contains information about authentication activities made through your on-premises Active Directory, including LDAP simple binds to domain controllers. Querying this table is the correct way to identify such binds.

Why the Other Options Are Wrong

SigninLogs (C) and AADServicePrincipalRiskEvents (A) are Microsoft Entra ID (Azure AD) tables, not on-premises AD DS authentication. AADDomainServicesAccountLogon (B) relates to Entra Domain Services, not the on-premises AD DS forest synced to the tenant.

Community Comment Notes

The community is unanimous (D 100). DChilds (11 likes) provides a sample IdentityLogonEvents query, and talosDevbot cites the table reference noting it holds on-premises AD authentication. laddu001 mistakenly suggests B, but D is the documented table.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/identitylogonevents

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. DChilds 👍 11 Answered D
    Here is a sample query from Microsoft Learn documentation: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/identitylogonevents
  2. laddu001 👍 2
    , the correct table to query for identifying LDAP simple binds to the AD DS domain controllers is AADDomainServicesAccountLogon.\
  3. talosDevbot 👍 1 Answered D
    IdentityLogonEvents table - Table that holds info about authentication activities made through your on-premises Active Directory https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/identitylogonevents
  4. e072f83 👍 1 Answered D
    https://techcommunity.microsoft.com/t5/security-compliance-and-identity/enhancing-microsoft-defender-for-identity-data-using-microsoft/ba-p/2178286
  5. pk69 👍 3 Answered D
    IdentityLogonEvents

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide