How to give Sentinel permissions to run playbooks

Question

We are just starting to build out our Sentinel deployment. I've just created by first playbook which runs fine manually. I need to create an automation that will run the playbook. When I selected "run playbook" under actions in the automation there were no playbooks in the next drop down to select. As I understand it Sentinel needs permission to run playbooks which it does with the Azure Sentinel Automation Contributor role (??). I spoke with our admin and he said he did give the resource group permissions to the playbooks but when I check it lists the resource group but with "No permissions".

How do we give Sentinel the appropriate permissions that will allow automations to run playbooks? In all the documentation I've found it simply states that this is done with the Azure Sentinel Automation Contributor service role.

Answer 1

Hi @Tux-nader

The automation rule will only detect those playbooks who has 'Azure sentinel incident' related triggers and not the 'Azure sentinel alerts' related ones.
Try to create playbook with the the trigger 'When Azure Sentinel incident creation rule was triggered' and you will be able to see the playbook as an action in the automation rule.

Please let me know if this works for you.

Thanks,
Yash

Answer 2

@Tux-nader Thanks for reaching out and apologies for delay on this. In order to for Sentinel to run the Playbooks, Sentinel also needs permission on the resource group under which you have created the playbook. You can assign this permission from here :

After clicking on Configure permission, it will list various Resource groups, you need to select the resource group where you have created the playbook.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

Answer 3

Thank you for the response. I did work with our admin to add the Resource group where the playbooks are created but I still cannot assign any playbooks to automations. When I try and add a playbook to an automation the drop down doesn't even display any of the two playbooks we've created.

Answer 4

Hi,

I have the same issue. I was assigned the resource group owner role and I have security admin role on all resource groups plus the Sentinel Contributer role. However, despise all of these roles I cannot see the playbooks on automation tab. I

above you can see the sentinel playbooks we have got. I can manage these playbooks. However, on the automation tab I see;

Permission on allowed resource, which host all the sentinel playbooks.

However, when I try to add an automation rule I get the following error

no playbooks visible

Answer 5

Link to documentation.

https://learn.microsoft.com/pt-br/azure/sentinel/roles?WT.mc_id=WDIT-MVP-5003815