Block-AADUser Playbook - Permissions error

Hello, I'm having some trouble implementing the "Block-AADUser Playbook" from the Microsoft Sentinel GitHub repo. I have already done the steps required: Assign Microsoft Sentinel Responder role t...

apis

playbooks

soar

BillClarksonAntill

Sep 22, 2023

costaluisc

Check out the below

$MIGuid = "<Enter your managed identity guid here>"
$MI = Get-AzureADServicePrincipal -ObjectId $MIGuid

$GraphAppId = "00000003-0000-0000-c000-000000000000"
$PermissionName1 = "User.Read.All"
$PermissionName2 = "User.ReadWrite.All"
$PermissionName3 = "Directory.Read.All"
$PermissionName4 = "Directory.ReadWrite.All"

$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"
$AppRole1 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName1 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole1.Id

$AppRole2 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName2 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole2.Id

$AppRole3 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName3 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole3.Id

$AppRole4 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName4 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole4.Id

This code snippet can be found here

https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Block-AADUserOrAdmin

BillClarksonAntill

Iron Contributor

Sep 14, 2023

so in order to authenticate API connections you do need global administrator to approve the API connections

When this happens your permissions are used as the connection authentication, in this particular example you need permissions to azure active directory from the logic app, so the API connection needs the appropriate permissions to perform this function

costaluisc
Copper Contributor
Sep 19, 2023
Add a global admin autorize the API connections.
Still have the same error.

Any ideas?

Thanks
- Christian_Bartsch
  Brass Contributor
  Sep 19, 2023
  Can you provide the raw outputs and inputs of each action from the run history?
  - costaluisc
    Copper Contributor
    Sep 20, 2023
    Sorry i had made some changes to the logic app and forgot to revert them.
    After the Global Admin authorized the API connection i have a different error message:
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
    "date": "2023-09-20T08:47:00",
    "request-id": "c6e062ba-c64b-4e6b-xxxxx",
    "client-request-id": "c6e062ba-c64b-xxxxx"
    }
    
    where are the permissions assigned to the connection API:
    
    The only action that has problems is the "Update User". I already tried changing just a field in the account and got the same error (the account is cloud only):
    {
    "method": "patch",
    "path": "/v1.0/users/teste%40xxxxx.onmicrosoft.com",
    "host": {
    "connection": {
    "name": "/subscriptions/b77f631f-be70-4922xxxxx/resourceGroups/xxxxxx/providers/Microsoft.Web/connections/azuread-Block-AADUser-Incident"
    }
    },
    "body": {
    "accountEnabled": false
    }
    }
    
    I have also run only the "Update User" step with both the UPN and User ID typed directly in the action and got the same error.
Christian_Bartsch
Brass Contributor
Sep 17, 2023
I think it’s not an permission error at that point. The error message states it didn’t find the resource. So my best guess is, the playbook fails to extract the proper ID or UPN (whatever is used in the HTML PUT action).

Forum Discussion

Block-AADUser Playbook - Permissions error

Resources