You are a global administrator in a company with Microsoft 365 E5 licenses assigned to your users. The company is planning onboarding to Azure Sentinel as a solution to proactively detect and stop threats. You will be deploying the solution. What is the first thing you must do?

Answer options:

A.Create a new Log Analytics Workspace
B.Upgrade your license to Microsoft Defender for Office 365 plan 2 
C.Create a conditional access policy
D.Within Azure Sentinel, connect a data source.

Correct Answer: A 
To enable Azure Sentinel, you must first create a Log Analytics Workspace. After it is created you will add Azure Sentinel to the new workspace: 

After these steps are completed you can start configuring your Sentinel solution by adding data sources. Option B is incorrect. This is not a requirement to deploy Azure Sentinel.
Option C is incorrect. Creating a conditional access policy is not relevant in this scenario.
Option D is incorrect. You must first create a Log Analytics Workspace and the add Sentinel to the workspace.
Reference: 
To know more about onboarding to Azure Sentinel, please refer to the link below: 

https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard