Manage a security operations environment
Microsoft Sentinel SIEM Platform
CoreApply Sentinel roles, data tiers, workbooks, and SOC optimization recommendations without confusing authorization, storage, visualization, and detection.
Aligned to SC-200 skills measured as of July 28, 2026; product behavior verified September 18, 2026.
Why this matters
The platform has separate controls for who may act, where data is retained, how analysts explore it, and how the SOC controls cost. Choosing the wrong layer can either block responders or retain expensive data without improving investigations.
Must Know
- Microsoft Sentinel Reader supports viewing; Responder adds incident management; Contributor adds broader Sentinel configuration. Azure RBAC scope determines which workspaces inherit access.
- Keep frequently queried operational data in an interactive tier and use the data lake for longer-retained, large-scale analysis when that access pattern fits.
- Workbooks are parameterized visualizations over data; they do not create alerts or execute containment.
- SOC optimization findings are recommendations. Validate data, detection, compliance, and operational dependencies before applying them.
Compare and Distinguish
- Reader inspects data and incidents; Responder can manage incidents; Contributor adds broader Sentinel configuration capabilities.
- Analytics tier supports interactive security operations; data lake storage supports longer retention and large-scale investigation patterns.
- A workbook visualizes and explores results; an analytics rule creates detections; a playbook runs response actions.
Scenario examples
- Scenario: An analyst must assign and close incidents but not change connectors. Think: choose a responder-oriented role at the workspace scope.
- Scenario: Recent logs need fast interactive queries while older data is retained for investigations. Think: align table tier and retention with each access pattern.
- Scenario: A recommendation promises savings but would reduce useful coverage. Think: evaluate operational context before applying it.
Exam traps
- Permission on one workspace does not grant access to a sibling workspace.
- Changing incident severity cannot move records between Analytics and data-lake tiers.
- A workbook can reveal a gap but cannot replace the connector or analytics rule that closes it.
- Cost reduction is not a sufficient reason to remove telemetry required by an active detection.
Key takeaways
- Match the Sentinel role and Azure scope to the analyst task.
- Place data according to retention and query behavior.
- Use workbooks to explore; use detections and automation for operational effects.
How it works
- Azure RBAC applies a Sentinel role at a resource scope and lets descendants inherit that assignment.
- Workbooks issue queries in the selected workspace and time context; SOC optimization evaluates observed coverage and cost signals.
Objects and administrative surfaces
- Azure role assignments at resource-group or workspace scope.
- Microsoft Sentinel data management for table tier and retention decisions.
- Workbook gallery and editor for KQL-backed visual analysis; SOC optimization for recommendations.
When to use it
- Use workbooks for interactive operational views and parameters.
- Use data-tier and retention controls when the question is how long records remain and how analysts query them.
Security and governance implications
- Prefer workspace or resource-group role scope over subscription-wide access when duties are local.
- Document any optimization change that removes data or detection coverage.
Troubleshooting signals
- If a user sees one workspace but not another, compare role assignments and scopes.
- If a workbook is empty while Logs returns data, check its workspace, subscription, time range, and parameters.
More detail
- Microsoft Sentinel Reader supports viewing; Responder adds incident management; Contributor adds broader Sentinel configuration. Azure RBAC scope determines which workspaces inherit access.
- Keep frequently queried operational data in an interactive tier and use the data lake for longer-retained, large-scale analysis when that access pattern fits.
- Workbooks are parameterized visualizations over data; they do not create alerts or execute containment.
- SOC optimization findings are recommendations. Validate data, detection, compliance, and operational dependencies before applying them.
Ready for the quiz?
- Which role lets an analyst assign and close incidents without editing connectors?
- Where should rarely queried long-term data reside?
- What dependencies must be checked before accepting an optimization recommendation?
Related objectives
- D1.2.S1 — Specify Microsoft Sentinel roles
- D1.2.S2 — Manage data retention for XDR and Microsoft Sentinel tables, including Analytics, Data lake, and XDR tiers
- D1.2.S3 — Create and configure Microsoft Sentinel workbooks
- D1.2.S4 — Optimize the Microsoft Sentinel platform, including SOC optimization recommendations