Microsoft 365 Administrator Expert MS-102 Practice Question

The most direct way to create continuous, in-portal alerting from an advanced hunting query is to save it as a custom detection rule. Custom detections let you set a schedule (for example, hourly) and define the alert title, severity, and impacted entities. Each time the scheduled query returns results, Microsoft 365 Defender raises an alert that is automatically correlated into the relevant incident timeline. Bookmarks only save individual query results for later review and do not generate alerts. Exporting the query to Microsoft Sentinel would require additional configuration in a different product and is outside the scope of creating an alert entirely inside Microsoft 365 Defender. Safe Links policies protect against malicious URLs and have no effect on PowerShell telemetry.