Deploying and Managing Microsoft Sentinel as Code

Hi All,

Within my solution, I need to query data that is within another log analystics workspace. This workspace contains confidential data and access rights are only granted to specific persons. The service principal (that is used to deploy the solution using the DevOps multistage pipeline) will never get access to the workspace.

Because of the missing access rights, the deployment of my solution fails.

I also discovered that some Sentinel connectors need global administrator rights. We also do not allow assinging these rights to the service principals. This might result into another issue that makes it impossible to use DevOps pipelines.

Does anyone have ideas how to solve these access rights issues?