You are planning the deployment of Microsoft Sentinel. Which type of Microsoft Sentinel data connector should you use to meet the security…

The question, while lacking specific requirements, is framed within the context of the AZ-801 exam, which focuses on Windows Server hybrid environments. A primary security requirement in such environments is protecting on-premises Active Directory Domain Services (AD DS). Microsoft Defender for Identity is the specialized cloud-based security solution that uses on-premises AD DS signals to detect advanced threats, compromised identities, and malicious insider actions. Its dedicated data connector streams these critical security alerts into Microsoft Sentinel, providing essential visibility into the on-premises portion of a hybrid identity infrastructure.

A. The Threat Intelligence - TAXII connector is used for ingesting external threat indicator feeds, not for monitoring internal Active Directory security events.

B. The Azure Active Directory connector ingests logs related to cloud-based identity (Azure AD), not on-premises Active Directory Domain Services.

C. Microsoft Defender for Cloud provides broader security posture management for workloads but lacks the specialized focus on on-premises Active Directory traffic analysis that Defender for Identity provides.

1. Microsoft Learn. "Connect Microsoft Defender for Identity data to Microsoft Sentinel." Microsoft Docs. This document states

"Microsoft Defender for Identity...is a cloud-based security solution that leverages your on-premises Active Directory signals to identify

detect

and investigate advanced threats...The Microsoft Defender for Identity connector allows you to stream all your Microsoft Defender for Identity security alerts into Microsoft Sentinel."

2. Microsoft Learn. "What is Microsoft Defender for Identity?." Microsoft Docs. This article defines the service's purpose: "Microsoft Defender for Identity...helps protect your hybrid identity environment...by monitoring user behavior and activities."

3. Microsoft Learn. "Connect Azure Active Directory (Azure AD) data to Microsoft Sentinel." Microsoft Docs. This source clarifies that the Azure AD connector streams Azure AD Sign-in

Audit

and Provisioning logs

which are distinct from on-premises AD DS security signals.

4. Microsoft Learn. "Connect threat intelligence data to Microsoft Sentinel." Microsoft Docs. This document details the function of threat intelligence connectors

including TAXII

which is to import threat indicators to enrich security data

not generate alerts from a specific source like AD DS.