AAD Risky User Playbook Authorization Reqest Denied

Question

Hello,&nbsp;New to Azure Sentinel, setting up the AAD Risky User Playbook.&nbsp; I did the app registration.&nbsp; Not sure how to connect the registration to Playbook.&nbsp; When I ran the playbook I got the following error:&nbsp;Does anyone know what the issue may be?&nbsp; Thanks for your help.&nbsp; --James

thijs lecomte · Answer

What permissions did you provide to the app registration? Can you provide us a screenshot

jbender · Answer

Thijs Lecomte&nbsp;&nbsp;Here you go sir.

thijs lecomte · Answer

Permissions look okay to me! You have configuration authentication within that HTTP action in the Playbook? Could you share it (with the secret removed ofcourse)

jbender · Answer

Is this what you want to see?&nbsp;&nbsp;Thijs Lecomte&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

thijs lecomte · Answer

Have you given the Managed Identity the correct permissions/role?Right now you are not utilizing the app registration you showed in a previous step.You should either:- Provide the correct permissions to the Managed Identity (https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal)- Use the app registration for authentication (use the Active Directory OAuth authentication option)

Forum Discussion

AAD Risky User Playbook Authorization Reqest Denied

6 Replies

Resources