Exam SC-200 Topic 3 Question 201 Discussion

Explanation:

In Microsoft Sentinel (part of Microsoft Defender XDR), data connectors are used to integrate log sources for security analytics and monitoring.
For Microsoft Teams , the correct and most efficient connector is Office 365 . Microsoft Teams logs- including user activities, chat events, and team management actions-are part of the Office 365 audit logs .
Microsoft Sentinel provides a built-in Office 365 connector that ingests auditing data from Exchange Online, SharePoint Online, and Microsoft Teams directly from the Microsoft 365 security and compliance center.
This connector requires only minimal configuration (enabling audit logging and connecting the tenant), satisfying the requirement to minimize administrative effort .
For Linux virtual machines hosted in Azure , the appropriate connector is Syslog . Linux systems send their security and operational events via Syslog, and Microsoft Sentinel supports this natively through the Syslog data connector . The Syslog agent (Log Analytics agent or AMA) collects logs and sends them to the Sentinel workspace. This connector is purpose-built for Linux VMs and ensures that authentication, authorization, and system logs are captured for correlation and threat detection.
Therefore:
* Microsoft Teams # Office 365 (because Teams audit data flows via Office 365 logs)
* Linux virtual machines in Azure # Syslog (because Linux uses Syslog for event forwarding) This configuration follows Microsoft's documented best practices for Sentinel data ingestion with minimal setup and maximum native integration.