Unit 1: Introduction

Once Microsoft Entra ID is deployed, ongoing monitoring and maintenance become critical to security, availability, and compliance. Identity systems are continuously targeted by attackers, misconfigurations, and unintended access changes. Microsoft Entra ID provides built-in audit, sign-in, and diagnostic logs that allow administrators to understand who accessed what, from where, and why.

This module focuses on visibility and response, not configuration. You learn how to interpret identity activity, investigate access issues, export logs to security platforms, and continuously evaluate your organization’s identity security posture.

Purpose of this module

This module teaches you how to:

• Detect and troubleshoot authentication problems.
• Investigate suspicious sign-in behavior.
• Track configuration and directory changes.
• Integrate Microsoft Entra logs with SIEM solutions.
• Monitor identity security posture over time.

This knowledge is exam-critical because many SC-300 questions test:

• Which logs to use for a given scenario.
• Who can access which logs.
• Licensing implications.
• How identity monitoring integrates with Sentinel or third-party SIEM tools.

What you will learn in this module

By completing this module, you will understand how to:

• Analyze sign-in logs to troubleshoot user access issues.
• Review audit logs to track directory and configuration changes.
• Enable diagnostic logs and forward them to Log Analytics or Microsoft Sentinel.
• Export logs to third-party SIEM solutions.
• Review Microsoft Entra activity using workbooks and reports.
• Monitor identity security posture using Identity Secure Score.
• Configure notifications for identity-related events.