Configuring Automatic Response to Azure AD Risky Sign-Ins in Azure Sentinel

Correct Answer: D

You must first connect Azure Sentinel to Azure AD Identity Protection to receive alert data into Sentinel.

Option A is incorrect.

While you can use Logic Apps in playbooks to automate your incident response and remediate security threats detected by Azure Sentinel, you first have to connect Sentinel to Azure AD Identity Protection to receive data into the solution.

Option B is incorrect.

Workbooks allows you to visualize and monitor data received from a connected source.

Hence not the correct answer.

Option C is incorrect.

Playbooks are indeed created to automate and orchestrate response to incidents and security threats based on workflows built in Azure Logic Apps.

But in this scenario you first have to connect Azure Sentinel to the Identity Protection data source.

Hence it is not the correct answer.

To know more about connecting Sentinel to identity protection, please refer to the link below:

To automatically respond to Azure AD risky sign-ins within Azure Sentinel, you must first configure a playbook.

A playbook is a set of instructions that define an automated response to a specific security event or incident. It enables you to automate the response process and can include multiple steps, such as alert notifications, remediation actions, and documentation.

To configure a playbook in Azure Sentinel, you can follow these steps:

1. Open the Azure Sentinel workspace in the Azure portal.
2. Click on "Playbooks" in the left-hand menu.
3. Click on "Add playbook" to create a new playbook.
4. Choose the "Azure AD risky sign-ins" template as the trigger for the playbook.
5. Configure the actions that you want the playbook to perform in response to the trigger event.
6. Save the playbook and enable it to begin running.

Once the playbook is configured, Azure Sentinel will automatically respond to Azure AD risky sign-ins according to the defined actions in the playbook.

In addition to configuring a playbook, you may also need to configure a data connector to ingest Azure AD sign-in data into Azure Sentinel. This can be done by selecting the Azure Active Directory connector from the available connectors and configuring it with the appropriate settings. However, this is not the first step you need to take when configuring an automated response to Azure AD risky sign-ins.