A security analyst must retain Microsoft Entra sign-in logs for 18 months and run scheduled KQL queries that join sign-in events with custom watchlists for threat hunting. The Microsoft Entra admin centre only retains sign-in logs for a limited period. Where should the logs be sent so that both the retention and the KQL hunting requirements are met?
- AConfigure a diagnostic setting to archive the sign-in logs to an Azure storage account, then query the archived files with KQL whenever the analyst needs to hunt across the retained data.
- BConfigure a diagnostic setting to stream the sign-in logs to an Azure event hub, then attach a Log Analytics workspace to the event hub so KQL queries can run against the streamed events.
- CConfigure a diagnostic setting to send the sign-in logs to a Log Analytics workspace, set the workspace table retention to 18 months, and run the scheduled KQL hunting queries directly in the workspace. Correct
- DIncrease the sign-in log retention period in the Microsoft Entra admin centre to 18 months and run the KQL hunting queries against the logs from within the admin centre's log blade.
Why A is wrong: Archiving to a storage account meets long retention cheaply but storage accounts do not support KQL queries, so the threat-hunting requirement cannot be satisfied from that destination.
Why B is wrong: An event hub is for streaming to external or third-party systems and does not itself store data for KQL, and a workspace cannot be attached to an event hub to query it, so this misroutes the data.
Why C is correct: A Log Analytics workspace stores sign-in logs in queryable tables, supports configurable retention up to and beyond 18 months, and is the destination where KQL joins against watchlists run, so it meets both requirements.
Why D is wrong: Microsoft Entra log retention in the admin centre is fixed by licence and cannot be extended to 18 months there, and the admin centre log blade does not run arbitrary KQL joins against custom watchlists.