Forum Discussion

Pranesh1060's avatar
Pranesh1060
Brass Contributor
Jun 12, 2020

User Risk Confirmation Using Logic Apps

Hello,

 

We have been working on one of the playbooks available on https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/Confirm-AADRiskyUser to confirm/dismiss user risks using playbook.

We deployed the playbook as a template, made required changes and tried triggering the playbook it failed. 

Alternatively tried creating a fresh one with the same logic, but it failed.

1) System assigned identity didn't work

2) Tried with user assigned identity it failed

3) Tried with AD OAuth it failed as well.

App has user.readwrite.all permissions, managed identity was added into security administrator role and still the same result. 

The error that we encounter for all the 3 ways is "code: AccessDenied, message: Your account does not have access to this report or data. Please contact your global administrator to request access". Ironically the 1st http connector that fetches the data of the user works like a charm and for all the 3 identities. It's just that writing back is an issue. Is there anything that we are missing from our end?

 

Do we have playbooks for dismissing sign-in risks as well? If not atleast the API reference to create a playbook. I tried with adminconfirmedsafe but it didn't work.

 

Please assist.

 

  • You need to add application permissions, not delegated permissions
  • Thijs Lecomte's avatar
    Thijs Lecomte
    Bronze Contributor
    You should configure the system assigned identity with the security admin role.

    Or the app you have configured needs the permission 'IdentityRiskyUser.ReadWrite.All'
    • Pranesh1060's avatar
      Pranesh1060
      Brass Contributor

      Thijs Lecomte 

      Many thanks for your response. However, if you check I have already mentioned that we have tried by assigning read.write permissions to the app and also tried by assigning security admin role to it and it still failed.

      • Thijs Lecomte's avatar
        Thijs Lecomte
        Bronze Contributor
        Could you share the permissions you have added to the app registration please?
        In a screenshot if possible

Share

Resources