Blog Post

Microsoft Sentinel Blog
6 MIN READ

Automatically disable On-prem AD User using a Playbook triggered in Azure

Inwafula's avatar
Inwafula
Icon for Microsoft rankMicrosoft
Feb 09, 2021
Many organizations have an on-premises Active Directory infrastructure that is synced to Azure AD in the cloud. However, given that the on-prem side is the authoritative source of truth, any changes,...
Updated Nov 01, 2021
Version 3.0
Inwafula's avatar
Icon for Microsoft rankMicrosoft
Joined November 11, 2017
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Microsoft Sentinel by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

Inwafula's avatar
Inwafula
Icon for Microsoft rankMicrosoft
Mar 22, 2023

Hi Vigitalmoe13 have you tried the below:

i. Azure AD Sync Connect issue with permission error 8344 - Microsoft Q&A

 

ii. Ensure that the user you are running AAD sync under, has the following permissions on the ‘root’ of your local AD domain.

  • Replicating Directory Changes: Allow
  • Replicating Directory Changes All: Allow     

 

iii. If you have Microsoft Defender for Identity you can follow the steps here as opposed to this logic app: Remediation actions - Microsoft Defender for Identity | Microsoft Learn