Onboarding Microsoft Sentinel starts by enabling Sentinel on an existing Log Analytics workspace and then connecting data sources so analytics can operate on ingested security data. Microsoft's Sentinel onboarding guidance emphasizes that after you add Sentinel to a workspace, you must "connect Microsoft services, non- Microsoft solutions, and custom sources" using built-in data connectors. Microsoft also states that "you need data in your workspace before you can use Microsoft Sentinel's analytics, hunting, and investigation capabilities." Features such as custom analytics rules, hunting queries, and incident correlation depend on ingested telemetry from sources like Microsoft Entra ID sign-in logs, Microsoft 365, Defender products, firewalls, and other appliances. Because the question already gives you a Log Analytics workspace (the prerequisite for enabling Sentinel), the first action in the onboarding workflow that unlocks Sentinel's value is to connect your security sources. Only after data is flowing should you proceed to create analytics rules, hunting queries, and incident processes. Therefore, the correct first step to onboard Microsoft Sentinel is connect to your security sources.

Explanation:

Microsoft's identity guidance classifies social identity services (e.g., GitHub, Google, Facebook) as cloud- based identity providers that can be used for external identities with Microsoft Entra ID. In this model, GitHub functions as an IdP using OAuth/OpenID Connect to authenticate users and issue tokens that applications or Entra ID can accept. Federation in Microsoft terms is the trust relationship that allows SSO across organizational boundaries and with multiple identity providers, such as Active Directory Federation Services (AD FS), SAML, or OpenID Connect providers, so users can authenticate once and access multiple apps without repeated sign-ins.
Crucially, SCI materials distinguish roles: an identity provider primarily handles authentication (proving who the user is and issuing claims/tokens). Authorization-deciding what the user can do-is enforced by the application or resource (often using roles/claims from the IdP). Auditing spans multiple planes: the IdP provides sign-in and audit logs, while applications and other services maintain their own activity logs.
Therefore, it is incorrect to say a central IdP "manages all modern authentication services" including authorization and auditing; those responsibilities are shared across the identity platform and the relying applications/resources.

Explanation:
Yes
NO
NO
YES - As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have.
NO - The most restrictive lock in the inheritance takes precedence.
NO - If you delete a resource group with a locked resource, the portal UI will give you an error and no resources are deleted.
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

Explanation:

Microsoft Entra Conditional Access (CA) evaluates signals from the user, device, location, and risk to make access decisions. The platform explicitly notes that CA decisions occur after primary sign-in: "Conditional Access policies are enforced after the first-factor authentication has been completed." This means a user must successfully present their initial credentials (e.g., password, Windows Hello, FIDO2) before the CA engine evaluates policy logic. Therefore, the statement that CA is evaluated before a user is authenticated is not correct.
Regarding scoping, CA can target ordinary and privileged identities. The assignment options allow administrators to aim policies at users, groups, and directory roles: "You can include or exclude users and groups... [and] include or exclude specific Azure AD directory roles from a Conditional Access policy." Because Global Administrator is a directory role, policies can be applied to those accounts (with Microsoft's best-practice guidance to maintain at least one excluded break-glass account to prevent lockout).
For signals/conditions, CA supports device platform filtering. The documented device platform condition states: "This condition is based on the operating system platform of the device... iOS, Android, Windows, macOS (and others)." Administrators commonly use this to require different controls (like MFA or compliant device) based on Android or iOS.
Putting these together:
* CA can apply to Global Administrators (Yes).
* CA is evaluated after first-factor authentication (No to "before").
* Device platform (e.g., Android/iOS) is a valid CA signal (Yes).

Microsoft Defender for Office 365 includes Safe Attachments, a protection that "checks attachments in a secure, virtual environment to detect malicious behavior." In Microsoft's guidance, Safe Attachments is described as part of the anti-malware pipeline that "routes messages with attachments to a detonation chamber; if no suspicious activity is detected, the message is released to the recipient, and if malicious behavior is found, the attachment is blocked or removed." Administrators can choose Block, Replace, Dynamic Delivery, or Monitor actions. The Dynamic Delivery option specifically supports the use case in the question: the email body is delivered while the attachment is scanned, and "the attachment is automatically reattached and forwarded to the recipient only when it is determined to be safe." This capability is unique to Defender for Office 365's Safe Attachments, not to be confused with endpoint antivirus or identity tools.
Defender Antivirus protects Windows devices, Defender for Identity secures on-premises identities, and Defender for Endpoint focuses on endpoint detection and response. Therefore, the Microsoft service you use to scan email attachments and forward them only when clean is Microsoft Defender for Office 365 (Safe Attachments).