When modifying an existing Azure Sentinel playbook (Logic App) to send emails to a dynamic recipient , such as the resource owner , you must make the email destination configurable. This is achieved by adding a parameter in the Logic App.
You then modify the action (the "Send an email" step) to use this parameter as the recipient field instead of a static distribution list. This enables flexibility, allowing the playbook to adapt dynamically based on alert context or Sentinel data fields passed into it.
In Microsoft Sentinel documentation, the best practice for dynamic logic app responses is:
"Use parameters to pass entity information (such as Account, Host, or Owner) from Sentinel alerts into playbooks for dynamic action execution." Hence, the verified answer is D. Add a parameter and modify the action .