You are a global administrator in a company with a Microsoft 365 subscription with Microsoft 365 E5 licenses assigned to your users. You have configured an Azure sentinel solution, and to further enhance your security, you want to integrate Threat Intelligence into your Sentinel solution. What should you do first?

Answer options:

A.In Azure, create a Key Vault
B.In Azure Sentinel, add the Threat Intelligence Platforms (Preview) Data connector
C.In Azure, create a log analytics workspace
D.In Azure Active Directory, register an application

Correct Answer: D 
You need to enable your solution to harvest information from Azure AD by registering an App registration in Azure AD. This enables your solution to connect and send threat indicators. 
After you have registered the application and configured API permissions, you can connect your Azure Sentinel solution to Threat Intelligence by navigating to Azure Sentinel – Data Connectors and selecting the Threat Intelligence Platforms connector.Option A is incorrect. Creating a key vault not relevant in this scenario
Option B is incorrect. This is the way to connect Sentinel to Threat Intelligence, but you must first register an application in Azure AD.Option C is incorrect. Creating a log analytics workspace is not relevant in this scenario. 
Reference: 
To know more about connecting Azure sentinel to threat intelligence, please refer to the link below: 

https://docs.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence