Your team wants high-severity “Impossible travel” incidents to automatically disable the affected user in Microsoft Entra ID, add the source IP to a Sentinel watchlist, and post a message to a SOC Microsoft Teams channel. You will use a Logic App playbook with a managed identity. What two actions should you perform?

To automate the response, you need a Logic App playbook triggered by Sentinel incidents. The playbook requires a system-assigned managed identity for secure authentication, and this identity needs specific permissions: Entra ID User Administrator to disable users and Microsoft Sentinel Contributor to add entries to watchlists. An automation rule in Sentinel is then configured to detect "Impossible travel" incidents with high severity and execute the created playbook. Incorrect options: An Azure Monitor action group is used for alerts from Azure Monitor, not directly for Sentinel incident automation. Assigning the Owner role at the subscription root is excessive and violates the principle of least privilege. The managed identity only needs specific permissions for the tasks it performs. Both Consumption and Standard Logic Apps can be triggered by Sentinel. The need for a Standard Logic App is not indicated by the requirements.