Forum Discussion

AVTMartijn's avatar
AVTMartijn
Copper Contributor
Dec 30, 2021

Repositories auto deployment fails for analytic rules with remote workspaces

Hi everyone,

 

I have just been experimenting with the newly added Repositories function to auto-deploy analytics rules from DevOps. It works fine when I deploy rules for the native workspace, but when a rule contains for example: "workspace('name').events" it fails.

 

The error states "Status Message: Make sure you have the necessary permissions on all the workspaces in your query, specifically on 'DemoSentinel'. (Code: Unauthorized)". So the pipeline cannot access the workspace, but manually I can create this rule. What permission do I need to set so the pipeline works?

 

Thanks!

1 Reply

  • bradleyfell's avatar
    bradleyfell
    Copper Contributor
    Jan 29, 2022

    Hi AVTMartijn 

     

    Consider making sure you meet all of the prerequisites?

    https://docs.microsoft.com/en-us/azure/sentinel/ci-cd?tabs=azure-devops&WT.mc_id=Portal-Microsoft_Azure_SentinelUS#prerequisites-and-scope

     

    More specifically, ensure you have Owner permissions on the resource group containing the workspace.