Exam SC-200 Topic 1 Question 245 Discussion

Explanation:

In Azure Security Center (now Microsoft Defender for Cloud), Workflow automation is provisioned as an ARM resource of type Microsoft.Security/automations. The automation resource defines one or more actions, and when the action is a Logic App, the actionType is set to LogicApp and the action must reference the Logic App by its resource ID. In ARM, the correct provider namespace for Logic Apps is Microsoft.Logic, so the template uses resourceId('Microsoft.Logic/workflows', <logicAppName>) to populate logicAppResourceId.
To enable the security alert to trigger the Logic App, the automation action includes a callback URL to the Logic App's manual trigger. In ARM, this is retrieved with listCallbackURL() against the trigger resource ID, which must also use the Microsoft.Logic provider, i.e., resourceId(<subscriptionId>,
<resourceGroupName>, 'Microsoft.Logic/workflows/triggers', <logicAppName>, 'manual'), with the Logic Apps API version such as 2019-05-01. This is the documented pattern for Security Center workflow automations: define an automation under Microsoft.Security/automations, specify an action of type LogicApp, reference the workflow by Microsoft.Logic, and obtain the manual trigger callback via listCallbackURL on Microsoft.Logic/workflows/triggers. This wiring ensures that when the specified security alerts are received, the automation invokes the Logic App for automatic remediation on each match.