You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server. You need to configure the collection of Windows Security event…

The "Minimal" event set collects only a small subset of events, which would likely miss important user audit trail information like sign-out events.

The "Common" event set configuration for Windows Security events in Microsoft Sentinel is specifically designed to provide a good balance between comprehensive audit coverage (including sign-in/out) and minimizing data volume, making it suitable for most security monitoring scenarios without requiring extensive customization. It focuses on key audit categories.

"All events" would capture a very high volume of events, significantly increasing ingestion costs and potentially making it harder to find relevant security events, thus failing the "minimize volume" requirement.

"Custom" would meet the specific requirements but requires significant administrative effort to identify and configure all necessary event IDs, failing the "minimize administrative effort" requirement.