Blog Post

Microsoft Sentinel Blog
11 MIN READ

Update Microsoft Sentinel VIP Users Watchlist from Azure AD group using playbooks

BenjiSec's avatar
BenjiSec
Icon for Microsoft rankMicrosoft
Mar 21, 2022
Last August, Watchlist built-in templates were announced in Public Preview as a new feature of Microsoft Sentinel. Data in watchlists can be correlated with analytics rules, viewed in the entity page...
Updated Mar 23, 2022
Version 2.0
AndrePKI's avatar
AndrePKI
Iron Contributor
Mar 30, 2022

BenjiSec @Good article, thank you, we are looking to implement this.

Are the Write permissions really necessary? Is it not sufficient to read (i.e use Directory Readers instead of User Administrator or *.Read.All instead of *.ReadWrite.All)?

I mean, from the functionality (maintain watchlists)  I derive that it is only necessary to read AAD objects - not modify (at least I hope so).