Forum Discussion

costaluisc's avatar
costaluisc
Copper Contributor
Sep 14, 2023
Solved

Block-AADUser Playbook - Permissions error

Hello, I'm having some trouble implementing the "Block-AADUser Playbook" from the Microsoft Sentinel GitHub repo. I have already done the steps required: Assign Microsoft Sentinel Responder role t...
apis
playbooks
soar
  • BillClarksonAntill's avatar
    BillClarksonAntill
    Sep 22, 2023

    costaluisc 

     

    Check out the below

     

    $MIGuid = "<Enter your managed identity guid here>"
$MI = Get-AzureADServicePrincipal -ObjectId $MIGuid

$GraphAppId = "00000003-0000-0000-c000-000000000000"
$PermissionName1 = "User.Read.All"
$PermissionName2 = "User.ReadWrite.All"
$PermissionName3 = "Directory.Read.All"
$PermissionName4 = "Directory.ReadWrite.All"

$GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'"
$AppRole1 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName1 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole1.Id

$AppRole2 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName2 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole2.Id

$AppRole3 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName3 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole3.Id

$AppRole4 = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName4 -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId `
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole4.Id

     

    This code snippet can be found here 

     

    https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Block-AADUserOrAdmin

costaluisc's avatar
costaluisc
Copper Contributor
Sep 18, 2023

Thanks Christian_Bartsch and BillClarksonAntill for the responses.
I'm currently waiting for a a Global Admin to authorize the API Connects.
Regarding the error, yes its strange that is not a permissions error. I already tried using the user UPN and AAD User ID, on multiple users and got the same error. The inputs to the "Update User" step are all ok.


I found a question regarding the same error but ended without a clear response.
Error when running playbook Block-AADUser-Alert - Microsoft Community Hub

Resources