SC-300 - Plan and Automate Identity Governance (25% of the exam) - Section 4.6

Monitor identity activity using sign-in and audit logs, diagnostic settings, KQL, workbooks, and Identity Secure Score.

Stream sign-in, audit, and provisioning logs to Log Analytics workspaces via diagnostic settings and write KQL queries to surface patterns in identity activity. Interpret workbooks and reports, act on Identity Secure Score recommendations, and recognise which log type contains evidence for a given investigation.

sign-in, audit, and provisioning logsdiagnostic settingsLog Analytics workspacesKQL queriesworkbooks and reportsIdentity Secure Score

Practice question for this objective

Free samplePlan and Automate Identity Governancemedium

A security analyst must retain Microsoft Entra sign-in logs for 18 months and run scheduled KQL queries that join sign-in events with custom watchlists for threat hunting. The Microsoft Entra admin centre only retains sign-in logs for a limited period. Where should the logs be sent so that both the retention and the KQL hunting requirements are met?

AConfigure a diagnostic setting to archive the sign-in logs to an Azure storage account, then query the archived files with KQL whenever the analyst needs to hunt across the retained data.
BConfigure a diagnostic setting to stream the sign-in logs to an Azure event hub, then attach a Log Analytics workspace to the event hub so KQL queries can run against the streamed events.
CConfigure a diagnostic setting to send the sign-in logs to a Log Analytics workspace, set the workspace table retention to 18 months, and run the scheduled KQL hunting queries directly in the workspace. Correct
DIncrease the sign-in log retention period in the Microsoft Entra admin centre to 18 months and run the KQL hunting queries against the logs from within the admin centre's log blade.

Sending Microsoft Entra sign-in logs to a Log Analytics workspace via a diagnostic setting enables long retention and full KQL querying including watchlist joins. Only a Log Analytics workspace stores Microsoft Entra logs in queryable tables that support KQL and configurable retention. A diagnostic setting routes the sign-in logs there, table retention can be set to 18 months, and KQL queries with watchlist joins run in the workspace. Storage accounts archive but cannot run KQL, event hubs stream rather than store for query, and admin centre retention is licence-bound.

Why A is wrong: Archiving to a storage account meets long retention cheaply but storage accounts do not support KQL queries, so the threat-hunting requirement cannot be satisfied from that destination.

Why B is wrong: An event hub is for streaming to external or third-party systems and does not itself store data for KQL, and a workspace cannot be attached to an event hub to query it, so this misroutes the data.

Why C is correct: A Log Analytics workspace stores sign-in logs in queryable tables, supports configurable retention up to and beyond 18 months, and is the destination where KQL joins against watchlists run, so it meets both requirements.

Why D is wrong: Microsoft Entra log retention in the admin centre is fixed by licence and cannot be extended to 18 months there, and the admin centre log blade does not run arbitrary KQL joins against custom watchlists.

See more SC-300 practice questions, answers explained.

Exam traps in Plan and Automate Identity Governance

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

Raise the sign-in log retention period inside the Microsoft Entra admin centre to eighteen months so the logs persist long enough.
Why it is wrong: It seems direct, but admin centre retention is capped well below eighteen months and cannot be extended that far, and it offers no KQL query surface.
A saved KQL query in the Log Analytics workspace, because a saved query stores the parameter pickers and charts so any team member can reopen the interactive report later.
Why it is wrong: A saved query stores query text for reuse but does not provide parameter pickers, layout, or a packaged interactive report, so it falls short of the shareable dashboard-style artefact the analyst wants.
Increase the Microsoft Entra sign-in log retention period in the admin centre so the existing logs become available to Log Analytics for KQL queries
Why it is wrong: The admin centre retention period is fixed by licence and cannot be extended there, and lengthening it would not push the logs into a workspace where KQL and watchlist joins are possible.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.