Hello,
We have been working on one of the playbooks available on https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Confirm-AADRiskyUser to confirm/dismiss user risks using playbook.
We deployed the playbook as a template, made required changes and tried triggering the playbook it failed.
Alternatively tried creating a fresh one with the same logic, but it failed.
1) System assigned identity didn't work
2) Tried with user assigned identity it failed
3) Tried with AD OAuth it failed as well.
App has user.readwrite.all permissions, managed identity was added into security administrator role and still the same result.
The error that we encounter for all the 3 ways is "code: AccessDenied, message: Your account does not have access to this report or data. Please contact your global administrator to request access". Ironically the 1st http connector that fetches the data of the user works like a charm and for all the 3 identities. It's just that writing back is an issue. Is there anything that we are missing from our end?
Do we have playbooks for dismissing sign-in risks as well? If not atleast the API reference to create a playbook. I tried with adminconfirmedsafe but it didn't work.
Please assist.
