Onboarding Microsoft Sentinel First Step
Short answer
C Connect to your data sources is the first action required to provide telemetry for Microsoft Sentinel.
Question
Key Takeaways
The exam tests the understanding of Microsoft Sentinel's operational workflow, specifically identifying that data ingestion via connectors must precede any security analysis or rule creation.
This question addresses the initial configuration required to onboard Microsoft Sentinel to an Azure Log Analytics workspace. It establishes that connecting data sources is the prerequisite step before creating detection rules or hunting queries.
Common mistake: Candidates often select 'Create a custom detection rule' (D) or 'Create a hunting query' (A), mistakenly believing that configuring analytics logic is the first step rather than enabling the data feed itself.
Expert Analysis
Why the Answer Is Correct
Microsoft Sentinel is a SIEM and SOAR solution that relies on data ingestion from various sources to function. Before you can create detection rules, incidents, or perform hunting, the platform must have data to analyze. Therefore, the first logical step after setting up the workspace is to connect data sources using connectors (such as Azure Activity Log, Office 365, or third-party logs). Without connected data sources, there is no telemetry for rules to trigger against.
Why the Other Options Are Wrong
Options A, B, and D represent subsequent steps in the Microsoft Sentinel lifecycle. Hunting queries (A) require existing data to search through. Correlating alerts into incidents (B) happens after alerts are generated by detection rules. Creating custom detection rules (D) requires both the workspace and active data feeds to be established; otherwise, the rules would have no context or data to evaluate. These actions are part of the 'Configure' and 'Operate' phases that follow the initial 'Connect' phase.
Community Comment Notes
The community consensus strongly supports option C. Users note that this process involves setting up connections between Microsoft Sentinel and data sources like Azure resources or Office 365. One commenter emphasized that using a connector is the fundamental mechanism for this onboarding step. The votes were unanimous, reflecting a clear understanding of the prerequisite nature of data connectivity.
Official Reference
https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always identify the foundational dependency in cloud security questions. If a task involves analyzing or monitoring something, check if the data source connection is listed as an option; it is almost always the first step. Memorize the Microsoft Sentinel architecture: Connect -> Configure -> Operate.
Frequently Asked Questions
Why can't I create a detection rule first?
Is creating a workspace enough to start Sentinel?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
MSMN91 👍 5Correct. This involves setting up connections between Microsoft Sentinel and your data sources, such as Azure resources, Office 365, or third-party solutions.
-
LegendaryZA 👍 2 Answered CAnswer: Connect to your data sources
-
TechyStacy 👍 1 Answered CUsing a connector to connect to data sources
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →