2.1. Configure the Microsoft Sentinel SIEM and Platform
💡 First Principle: A SIEM is shared infrastructure that many people touch and that costs money every day it runs. Two platform decisions shape everything downstream: who can change what (roles), and where each data set lives and for how long (tiers and retention). Get roles wrong and automation silently fails or analysts hold more power than they need; get tiers wrong and either detections can't see the data or the bill explodes.
Why care: platform misconfiguration is invisible until it hurts. A playbook that worked in the lab fails in production because the Sentinel service account was never granted permission to run it. A table moved to the data lake to save money stops feeding the analytics rule that caught last year's breach. These are exactly the "why doesn't this work?" scenarios the exam builds around.
The mental model is a warehouse with two storage zones and a staffed front office. The analytics tier is the front of the warehouse: expensive floor space, but everything is instantly reachable, so real-time detections and fast hunting live here. The data lake tier is the back storage: cheap and vast, ideal for keeping years of records, but you retrieve from it with deliberate jobs rather than reaching for it every minute. The roles decide who works the front desk, who can rearrange shelves, and which automated systems are allowed to move things on their own. Workbooks are the reporting wall in the front office, and SOC optimization is the consultant who walks the floor and tells you what's wasted space and what's missing.
⚠️ Common Misconception: "Microsoft Sentinel Contributor can do everything Sentinel needs." It can't create or edit playbooks (that's Logic App Contributor), and automation rules can't run playbooks until the Sentinel service account is granted Microsoft Sentinel Automation Contributor on the playbooks' resource group. A second trap treats the data lake tier as a cheaper analytics tier; it doesn't run real-time analytics rules, so detection data must stay in the analytics tier.
