Sentinel automation not showing playbooks from other subscriptions/resource groups

Copper Contributor

We manage several Sentinel workspaces from different subscriptions using multi-tenant workspace manager. We have several playbooks developed and existing in resource groups associated with these separate workspaces although the resource groups have been created in our central workspace. The issue is that when we go into the automation blade and view available playbooks, we are not able to see these subscriptions or playbooks. We normally can view all the subs connected to the workspace manager but now we can only see our dev subscription, not even the central. Because of this we can't see any of our other RGs or playbooks from within Sentinel.

Several automation rules are in place to call these playbooks and all this is still working so Sentinel is still able to access and run these playbooks. We can also see them through the Azure portal if we go to the individual RGs. Also, we are able to create new playbooks and deploy them to the RGs through the automation creation wizard. Is there a setting that got misconfigured that is causing us to not be able to see the playbooks?

3 Replies

@MikeHemming can you check to see if your access is still functioning

 

Do you still have at least the Microsoft Sentinel Contributor assigned to your account across all workspaces?

Yes, my access is there. We have Security groups deployed for my analysts to PIM into which contains Sentinel Contributor.
I wanted to make a quick update to this post for anyone else who might be running into this. After some troubleshooting, the issue appears to be a fault inside Sentinel where if there are two many workspaces selected, the automation tab can only display a few or one subscription and the accompanying RGs. In our case, since our dev environment is first alphabetically, it is showing only that one and none of the others, however if I select only our prod directory and subscription, we can see the RGs and playbooks from that sub. We are escalating this issue to Microsoft.