Jun 12 2020
05:53 AM
- last edited on
Jan 04 2022
12:25 PM
by
TechCommunityAP
Jun 12 2020
05:53 AM
- last edited on
Jan 04 2022
12:25 PM
by
TechCommunityAP
Hello,
We have been working on one of the playbooks available on https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Confirm-AADRiskyUser to confirm/dismiss user risks using playbook.
We deployed the playbook as a template, made required changes and tried triggering the playbook it failed.
Alternatively tried creating a fresh one with the same logic, but it failed.
1) System assigned identity didn't work
2) Tried with user assigned identity it failed
3) Tried with AD OAuth it failed as well.
App has user.readwrite.all permissions, managed identity was added into security administrator role and still the same result.
The error that we encounter for all the 3 ways is "code: AccessDenied, message: Your account does not have access to this report or data. Please contact your global administrator to request access". Ironically the 1st http connector that fetches the data of the user works like a charm and for all the 3 identities. It's just that writing back is an issue. Is there anything that we are missing from our end?
Do we have playbooks for dismissing sign-in risks as well? If not atleast the API reference to create a playbook. I tried with adminconfirmedsafe but it didn't work.
Please assist.
Jun 12 2020 11:48 AM
Jun 15 2020 01:27 AM
Many thanks for your response. However, if you check I have already mentioned that we have tried by assigning read.write permissions to the app and also tried by assigning security admin role to it and it still failed.
Jun 15 2020 02:48 AM
Jun 15 2020 04:49 AM
I've attached the screenshot. If this has worked for you, will it be possible for you to share the playbook with me, especially the HTTP writeback part?
Jun 15 2020 05:07 AM
Solution