Onboarding Microsoft Sentinel First Step
You have an Azure subscription that contains a Log Analytics workspace. You need to onboard Microsoft Sentinel. What should you do first?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the understanding of Microsoft Sentinel's operational workflow, specifically identifying that data ingestion via connectors must precede any security analysis or rule creation.
This question addresses the initial configuration required to onboard Microsoft Sentinel to an Azure Log Analytics workspace. It establishes that connecting data sources is the prerequisite step before creating detection rules or hunting queries.
Candidates often select 'Create a custom detection rule' (D) or 'Create a hunting query' (A), mistakenly believing that configuring analytics logic is the first step rather than enabling the data feed itself.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Sentinel is a SIEM and SOAR solution that relies on data ingestion from various sources to function. Before you can create detection rules, incidents, or perform hunting, the platform must have data to analyze. Therefore, the first logical step after setting up the workspace is to connect data sources using connectors (such as Azure Activity Log, Office 365, or third-party logs). Without connected data sources, there is no telemetry for rules to trigger against.Why the Other Options Are Wrong
Options A, B, and D represent subsequent steps in the Microsoft Sentinel lifecycle. Hunting queries (A) require existing data to search through. Correlating alerts into incidents (B) happens after alerts are generated by detection rules. Creating custom detection rules (D) requires both the workspace and active data feeds to be established; otherwise, the rules would have no context or data to evaluate. These actions are part of the 'Configure' and 'Operate' phases that follow the initial 'Connect' phase.Community Comment Notes
The community consensus strongly supports option C. Users note that this process involves setting up connections between Microsoft Sentinel and data sources like Azure resources or Office 365. One commenter emphasized that using a connector is the fundamental mechanism for this onboarding step. The votes were unanimous, reflecting a clear understanding of the prerequisite nature of data connectivity.Official Reference
Exam Strategy
Always identify the foundational dependency in cloud security questions. If a task involves analyzing or monitoring something, check if the data source connection is listed as an option; it is almost always the first step. Memorize the Microsoft Sentinel architecture: Connect -> Configure -> Operate.
Frequently Asked Questions
Why can't I create a detection rule first?
Detection rules need data to analyze. You must connect data sources so telemetry flows into the workspace before rules can trigger.
Is creating a workspace enough to start Sentinel?
No. While the workspace is the storage component, Sentinel requires active data connections via connectors to become operational.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →