You have a Microsoft 365 tenant. You plan to manage incidents in the tenant by using the Microsoft Defender XDR. Which Microsoft service source will appear on the Incidents page of the Microsoft 365…

The correct answer is D. Microsoft Defender for Identity. Microsoft Defender for Identity is a native Microsoft 365 Defender service source and its incidents appear directly on the Incidents page of the Microsoft Defender XDR portal. The natively integrated sources include Defender for Endpoint, Defender for Office 365, Defender for…

Submitted by packet_pusher· Apr 18, 2026Manage security and threats by using Microsoft Defender XDR

Question

You have a Microsoft 365 tenant. You plan to manage incidents in the tenant by using the Microsoft Defender XDR. Which Microsoft service source will appear on the Incidents page of the Microsoft 365 Defender portal?

Options

AMicrosoft Sentinel
BMicrosoft Defender for Cloud
CAzure Web Application Firewall
DMicrosoft Defender for Identity

How the community answered

(42 responses)

A
2% (1)
C
7% (3)
D
90% (38)

Explanation

Microsoft Defender for Identity is a native Microsoft 365 Defender service source and its incidents appear directly on the Incidents page of the Microsoft Defender XDR portal. The natively integrated sources include Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. Microsoft Sentinel (A) is a separate SIEM/SOAR product that integrates via connector but is not a native source listed on the Incidents page. Microsoft Defender for Cloud (B) is Azure-centric and not a default source. Azure Web Application Firewall (C) is not a direct Defender XDR incident source.

Topics

#Microsoft Defender XDR#Incident Management#Microsoft Defender for Identity#Security Operations

Community Discussion

No community discussion yet for this question.

Full MS-102 Practice