Forum Discussion

Copper Contributor

Oct 04, 2023

Solved

Problem with Playbook permissions through Lighthouse

I have two tenants where I test Azure Lighthouse and I'm having playbook permissions trouble while doing this. In the "customer" tenant I have established Sentinel and Playbooks. In this tenant all ...

Clive_Watson
Oct 05, 2023
I'm sure you have read these, but worth checking: https://learn.microsoft.com/en-us/azure/sentinel/mssp-protect-intellectual-property#playbooks and https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules#permissions-for-automation-rules-to-run-playbooks

Bronze Contributor

Oct 05, 2023

I'm sure you have read these, but worth checking: https://learn.microsoft.com/en-us/azure/sentinel/mssp-protect-intellectual-property#playbooks and https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules#permissions-for-automation-rules-to-run-playbooks

pednie
Copper Contributor
Oct 05, 2023
Thank you for the articles! I haven't actually found those two articles. I followed the last article and found the relevant information under
"An automation rule created in the customer workspace (while signed into the service provider tenant) is configured to run a playbook located in the customer tenant" which linked to this: https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents#permissions-to-run-playbooks

Azure Security Insights in service provider tenant was missing Microsoft Sentinel Automation Contributor role. I added the role through Lighthouse and my issue is resolved.

Thank you for help!
- AliAhmedDar
  Copper Contributor
  Oct 23, 2023
  pednie i have a question for you and for maybe Clive_Watson
  I am managing a customer's Sentinel and want to run response playbooks from under the Incidents tab.
  None of the resources are in my sentinel, infact I do not have any sentinel deployed. Still do I need to delegate Automation Contributor role to the Azure Security Insights app ?
  If yes, I do not see it the Enterprise applications menu

Resources