Forum Discussion
Solved
Unable to update rule New User Assigned to Privileged Role
When trying to update this analytic rule to latest version (1.0.10), I get this error message. Failed to save analytics rule 'New User Assigned to Privileged Role'. BadRequest:Invalid data model....
- That looks like a YAML error, I'm assuming you are deploying this rather than manually creating it? Check the entity mappings:
https://github.com/Azure/Azure-Sentinel/blob/0202a5a5797218909f035cea4db1037807152dbb/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/UserAssignedPrivilegedRole.yaml#L32
That looks like a YAML error, I'm assuming you are deploying this rather than manually creating it? Check the entity mappings:
https://github.com/Azure/Azure-Sentinel/blob/0202a5a5797218909f035cea4db1037807152dbb/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/UserAssignedPrivilegedRole.yaml#L32
https://github.com/Azure/Azure-Sentinel/blob/0202a5a5797218909f035cea4db1037807152dbb/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/UserAssignedPrivilegedRole.yaml#L32
Thank you Clive_Watson. I was able to review the entity mappings and sure it was missing the one for Name. Selected that and I was able to update the rule. Thank you for the quick response!