Querying IdentityLogonEvents to hunt LDAP simple binds to AD DS domain controllers

Respond to alerts and incidents in Microsoft Defender XDR
Answer Correct answer: D — IdentityLogonEvents records on-premises AD authentication, including LDAP simple binds to domain controllers.

Your on-premises network contains an Active Directory Domain Services (AD DS) forest. You have a Microsoft Entra tenant that uses Microsoft Defender for Identity. The AD DS forest syncs with the tenant. You need to create a hunting query that will identify LDAP simple binds to the AD DS domain controllers. Which table should you query?

  1. AADServicePrincipalRiskEvents
  2. AADDomainServicesAccountLogon
  3. SigninLogs
  4. IdentityLogonEvents Correct Answer
defender for identity identitylogonevents ldap simple bind hunting ad ds domain controller

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

IdentityLogonEvents is the advanced-hunting table that records on-premises AD authentication (including LDAP binds), whereas SigninLogs and the Entra tables cover Azure AD/Entra sign-ins, not on-prem AD DC binds.

To hunt LDAP simple binds to on-premises Active Directory Domain Services domain controllers in Defender for Identity advanced hunting, query the IdentityLogonEvents table, which holds authentication activities made through on-premises Active Directory.

Using SigninLogs or AADDomainServicesAccountLogon — those cover Entra/Azure AD authentication, not the on-premises AD DS LDAP simple binds captured by IdentityLogonEvents.

Community Discussion (5 comments)

DChilds 👍 11 Selected: D
Here is a sample query from Microsoft Learn documentation: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/identitylogonevents
talosDevbot 👍 1 Selected: D
IdentityLogonEvents table - Table that holds info about authentication activities made through your on-premises Active Directory https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/identitylogonevents
e072f83 👍 1 Selected: D
https://techcommunity.microsoft.com/t5/security-compliance-and-identity/enhancing-microsoft-defender-for-identity-data-using-microsoft/ba-p/2178286
laddu001 👍 2
, the correct table to query for identifying LDAP simple binds to the AD DS domain controllers is AADDomainServicesAccountLogon.\
pk69 👍 3 Selected: D
IdentityLogonEvents

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The IdentityLogonEvents table in Microsoft Defender for Identity advanced hunting contains information about authentication activities made through your on-premises Active Directory, including LDAP simple binds to domain controllers. Querying this table is the correct way to identify such binds.

Why the Other Options Are Wrong

SigninLogs (C) and AADServicePrincipalRiskEvents (A) are Microsoft Entra ID (Azure AD) tables, not on-premises AD DS authentication. AADDomainServicesAccountLogon (B) relates to Entra Domain Services, not the on-premises AD DS forest synced to the tenant.

Community Comment Notes

The community is unanimous (D 100). DChilds (11 likes) provides a sample IdentityLogonEvents query, and talosDevbot cites the table reference noting it holds on-premises AD authentication. laddu001 mistakenly suggests B, but D is the documented table.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/identitylogonevents

Related Analysis

You have 500 on-premises devices. You have a Microsoft 365 E

S-Grade

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have an Azure subscription that contains a Microsoft Sen

S-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide