You have a Microsoft 365 E5 subscription and a Microsoft Sentinel workspace.

To combine Microsoft Graph activity logs with Microsoft Entra ID Protection risky users , while minimizing data volume, you use the lookup kind=leftouter operator.

Microsoft documentation explains:

“Use lookup (instead of join) when you need to enrich a large dataset with a small lookup table to minimize data returned.”

MicrosoftGraphActivityLogs provides user activity records.

AADRiskyUsers lists users detected as risky by Entra ID Protection.

A leftouter lookup ensures all Microsoft Graph activity entri es are kept, while only matching risky user info is appended — reducing output volume compared to a full join .

✅ Correct Answer: A. MicrosoftGraphActivityLogs lookup kind=leftouter AADRiskyUsers on $left.UserId == $right.Id