Forum Discussion

Fergie635's avatar
Fergie635
Copper Contributor
Aug 04, 2019

Least Privilege Permissions on Log Analytics Workspace for Azure Sentinel

Hi

 

Documentation on the RBAC design for Azure Sentinel is a little vague. I am just enabling Azure Sentinel and wanted to understand the least privilege permissions (as we share the Log Analytics workspace with the Ops team). What are the least privilege permissions on a log Analytics workspace to create "Analytics alerts" in Azure Sentinel ?

 

 More Detail

 

I have experimented with the built in roles "Log Analytics Contributor" and "Monitor Contributor" on the resource group of the LogAnalytics workspace. Both of these roles do not allow me to create "Analytics" - "Alerts".
With the on "save" action popping out with the following error:
 
"Failed to save alert rule 1:12 AM Failed to save alert rule 'test'. Missing necessary permissions to perform this action."
 
Contributor on the LogAnalytics workspace allows me save the Analytics alert. Obviously trying to tie down access as tight as possible is there another built in role that I can apply? Or do I need to provide the Security operations team with Contributor access to this resource/resource group for other things (e.g. Dashboards, etc)?  

 

Thanks in advance for your assistance. 

2 Replies

  • Gary Bushey's avatar
    Gary Bushey
    Copper Contributor
    Aug 07, 2019

    Fergie635 Microsoft has a page that lists a lot of good recommendations.

     

    https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access

  • Nicholas DiCola (SECURITY JEDI)'s avatar
    Nicholas DiCola (SECURITY JEDI)
    Former Employee
    Aug 06, 2019

    Fergie635 

    Hi

    Our recommendation would be to give reader access to the resource group that the workspace resides in for the least privileges.  Obviously, readers wont be able to create analytics and dashboards.  If the team needs to be able to do that then give contributor to the RG that the workspace resides in.