Question

Your SOC uses Microsoft Sentinel and Microsoft Defender for Endpoint. Analysts triage incidents in the Sentinel portal and want to onboard a compromised device (isolate it) directly as a response action from a Sentinel automation rule triggered on Defender for Endpoint alerts. You have enabled the Microsoft Defender XDR data connector in Sentinel. During testing, the automation rule fires, but the device isolation action fails with a permissions error. What is the most likely cause?

Accepted Answer

The playbook's managed identity has not been granted a role that permits Defender for Endpoint device actions (such as the Microsoft Sentinel Automation Contributor plus a Defender for Endpoint API permission).

Answer

The Defender XDR connector only supports incident synchronization, so device isolation can never be automated from Sentinel and must be done manually in the Defender portal.

Answer

The analytics rule must be converted from scheduled to NRT before any device response action can execute.

Answer

Data retention on the workspace is set too low, causing the device entity to expire before the playbook runs.