Does Creating a Playbook Auto-Assign New Sentinel Incidents?

Implement activity and event collection in Microsoft Sentinel

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Sentinel workspace. You have a multi-tier Security Operations Center (SOC) team. You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage. Solution: You create a playbook. Does this meet the goal?

Yes
No Correct Answer

Answer Correct answer: B — Creating a playbook alone does not meet the goal; an automation rule triggered on incident creation must assign the Tier 1 group and tag for triage.

Community Insight

This item tests whether you know the Sentinel SOAR trigger chain — a playbook is only a Logic App workflow and needs an automation rule (or a manual run) to fire, which is the classic trap of assuming playbooks are self-triggering.

Creating a playbook in Microsoft Sentinel does not, by itself, assign new incidents to the Tier 1 analysts group or flag them for triage. The page confirms why an automation rule triggered on incident creation is the component that actually meets the goal.

Choosing "Yes" because playbooks can indeed assign an owner and add tags — learners forget the playbook never executes on its own for a new incident unless an automation rule calls it.

Community Discussion (3 comments)

Greens 👍 1 Selected: B

A playbook (Logic App) can update an incident, assign an owner and add tags, but it doesn’t run by itself. A playbook has to be triggered, either manually or by an automation rule. Creating a playbook alone doesn’t make anything happen when a new incident appears. The intended solution is an automation rule with the trigger When incident is created and the actions Assign owner (Tier 1 group) and Add tags (e.g. “Triage”). Automation rules can do this natively, so a playbook isn’t needed. You’d only add one, called from the automation rule, for logic that automation rules can’t handle themselves, such as calling external systems or sending enriched notifications.

Craigg 👍 1 Selected: A

This is a bad question. As its possible, but need the playbook to be assigned. Yes, security orchestration and automation tools (such as ServiceNow Security Incident Response or Microsoft Sentinel) can use playbooks to automatically assign, update, or route security incidents to specific tiers and groups like Tier 1 or a "New" status queue

Eltooth 👍 1 Selected: B

No Lack of Independent Triggering: A playbook in Microsoft Sentinel (built on Azure Logic Apps) is an automated workflow. However, it cannot execute itself automatically when a new incident arrives unless it is explicitly called by an Automation Rule.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A Microsoft Sentinel playbook is an Azure Logic App workflow that performs actions only when something invokes it. Nothing in the stated solution wires the playbook to the incident pipeline, so when a new incident is created nothing calls the workflow and no assignment or tag ever happens. The requirement — every new incident assigned immediately to the Tier 1 analysts group and flagged for triage — is fulfilled by an automation rule using the "When incident is created" trigger with an "Assign owner" action (Tier 1 group) and an action that adds a triage tag. Because the solution stops at creating the playbook, it does not meet the goal, so "No" is correct.

Why the Other Options Are Wrong

"Yes" is only defensible if the playbook is explicitly attached to a trigger, for example as the action of an automation rule; the scenario never states that, so the conditional precondition is missing. Playbooks genuinely can assign owners, change status, and add tags once they run, which is exactly why option A is tempting — the capability exists, but the activation does not. There is also an unstated dependency on the Logic App's connection/identity permissions, another reason creating the playbook alone proves nothing about the outcome.

Community Comment Notes

Greens reasoned that a playbook "can update an incident, assign an owner and add tags, but it doesn't run by itself" and pointed to an automation rule with the trigger When incident is created as the intended answer. Eltooth reached the same verdict, citing a lack of independent triggering for Logic App-based playbooks. Craigg voted the other way but still conceded that the playbook would need to be "assigned," which effectively confirms the missing trigger is the deciding factor.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules

Exam Strategy

In "Does this meet the goal?" sets, match the wording exactly against what was configured — Sentinel automation questions turn on the trigger, so if only a playbook is mentioned with no automation rule, answer No regardless of how capable the playbook is.

Frequently Asked Questions

Why doesn't creating a Sentinel playbook auto-assign new incidents?

A playbook is a Logic App workflow with no incident-created trigger of its own; it runs only when an automation rule or an analyst invokes it.

Which automation rule setup assigns Tier 1 analysts immediately?

Use the "When incident is created" trigger with an "Assign owner" action pointing to the Tier 1 group, plus an action that adds a triage tag.

More SC-500 FAQ →

Related Analysis

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide