Error giving permission to Logic Apps from Microsoft Sentinel

Lakshan Sameera 0 Reputation points
2024-09-20T20:37:16.02+00:00

I'm having trouble setting up email and SMS alerts with Sentinel due to issues with Logic Apps permissions. I've tried assigning contributor access to the relevant Logic App, but when I give permission through Manage Playbook Permission, I get the following error:

Successfully added permissions to 0 of 1 resource groups. Failure reason: The client 'live.com#lakshansameera333@gmail.com' with object id '9b27f6a5-f8c2-49d8-8f85-9461548df24c' has an authorization with ABAC condition that is not fulfilled to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/ca74980e-a77a-4320-8bb9-8635875ba56b/resourceGroups/Sentinel-X/providers/Microsoft.Authorization/roleAssignments/cc217894-38ec-47d9-9b70-0f8f05a05cc2' or the scope is invalid. If access was recently granted, please refresh your credentials.

WhatsApp Image 2024-09-21 at 02.04.46

Can someone help me troubleshoot this issue?

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
3,113 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,129 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pauline Mbabu 330 Reputation points Microsoft Employee
    2024-09-24T19:25:58.5933333+00:00

    Hello @Lakshan Sameera ,
    Thank you for your question.
    You can resolve this issue by two options. First is creating a custom role. Kindly follow this documentation to create a custom role with Microsoft.Authorization/roleAssignments/write permission and assign this role to the application. This is the best approach as the application is given the least privileged permissions needed.

    The other way would be to leverage the built in roles https://video2.skills-academy.com/en-us/azure/role-based-access-control/built-in-roles#contributor. Assign the Application with Owner role. However, this is not a best practice as this is not the least privileged approach.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.