You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector. You need to ensure that app1…

The correct answer is D. an automation rule. To trigger an Azure Logic App (playbook) in response to a Microsoft Sentinel alert, the first thing you must create is an automation rule. Automation rules evaluate conditions-such as 'alert generated by Azure AD connector'-and then execute actions, including running a playbook…

Submitted by takeshi77· Apr 18, 2026Detect and remediate threats using Microsoft Sentinel

Question

You have an Azure subscription that contains an Azure logic app named app1 and a Microsoft Sentinel workspace that has an Azure Active Directory (Azure AD) connector. You need to ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert. What should you create first?

Options

Aa repository connection
Ba watchlist
Can analytics rule
Dan automation rule

How the community answered

(37 responses)

A
8% (3)
B
3% (1)
C
11% (4)
D
78% (29)

Explanation

To trigger an Azure Logic App (playbook) in response to a Microsoft Sentinel alert, the first thing you must create is an automation rule. Automation rules evaluate conditions-such as 'alert generated by Azure AD connector'-and then execute actions, including running a playbook (logic app). An analytics rule would generate incidents from raw log data, which is a prerequisite step but not what directly triggers the logic app. A watchlist stores reference data, and a repository connection is for content management. The automation rule is what bridges the alert event to the logic app execution.

Topics

#Microsoft Sentinel#Automation Rules#Logic Apps#SOAR

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice