Microsoft · SC-300
Monitoring identity activity
SC-300 · Lesson 16 of 16 · 1:55:18
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-300 exam (Microsoft Identity and Access Administrator). In this lesson: the four types of sign-in logs, audit and provisioning logs, retention by license, diagnostic settings to Log Analytics, an event hub or storage, KQL queries and workbooks, and Identity Secure Score. Includes three original practice questions.
Preview the topics
- An auditor needs two years of Microsoft Entra audit logs, at the lowest cost, without querying them often. Where should you send them?
- You want a query that counts failed interactive sign-ins per user, over the last week. Which table do you start from in Log Analytics?
- A security director wants one number showing how well identity settings follow Microsoft’s recommendations, with a list of actions to improve it. What should you show?