I created a logic app in Tenant1 to connect to a Microsoft Sentinel in Tenant2. This logic app has to pull incidents and alerts.
What are the ways to achieve above scenario?
I did the below steps but the logic app is not triggering when an incident is created in sentinel.
1. Created a service principal in Tenant1.
2. Ran the below url to admin consent the above AAD in Tenant2
https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=<clientid>&scope=<scope>
3. Added role (Sentinel Reader, Sentinel Responder) to the above service principal (AAD) in the resource group in Tenant2.
4. Created a logic app and added a Microsoft Sentinel trigger in the logic app and the connection details has been updated with the above AADId, Tenantid and secret.
Any pointers or documentation of service principal connection in logic app to sentinel will be helpful.
