Question

Your SOC has built a Microsoft Sentinel playbook (Logic App) that must add a compromised user's account to an Azure AD group and post a message to a Microsoft Teams channel when triggered by an incident. Currently the playbook fails at the step that modifies the group membership with an authorization error, though the Teams step (which uses an API connection authenticated as a service account) succeeds. The playbook is configured to authenticate to Azure AD using its system-assigned managed identity. What is the MOST appropriate action to resolve the failure while following least-privilege practices?

Accepted Answer

Grant the playbook's managed identity the required Microsoft Graph directory role or permission needed to modify group membership

Answer

Assign the Sentinel Contributor role to the playbook's managed identity in the Sentinel workspace

Answer

Switch the Azure AD action to authenticate with the same service account connection used by the Teams step

Answer

Add the Owner role at the subscription level to the Logic App so it can perform any directory operation