Fix Azure Lighthouse Playbook Execution Permission Error in Microsoft Sentinel
Question details
An Azure Lighthouse service provider is unable to trigger playbooks from Microsoft Sentinel incidents due to missing or unverifiable delegated permissions.
- Product
- Microsoft Sentinel
- Device & OS
- not provided
- Scenario
- Attempting to execute an incident playbook in Microsoft Sentinel using Azure Lighthouse delegations.
- Observed behavior
- An error message appears indicating missing permissions to trigger playbooks or an inability for Microsoft Sentinel to verify the delegated permissions.
Ensure you have Azure portal administrative access with rights to review both Azure Lighthouse delegations and Microsoft Sentinel role assignments.
Review Lighthouse Delegations and Application Roles
Verify that your Azure Lighthouse delegation grants the necessary roles to the Azure Security Insights application for playbook execution.
Playbook execution requires specific permissions that extend beyond basic incident management. If Azure Security Insights cannot verify these permissions, the playbook trigger will fail.
Sign in to the Azure portal, search for 'Azure Lighthouse' in the top search bar, and select it from the services menu.
Navigate to the 'Delegations' section to locate the specific customer tenant and subscription where the incidents are being managed.
Ensure that the delegated roles include 'Microsoft Sentinel Responder' and either 'Logic App Contributor' or 'Automation Contributor' to allow playbook triggers.
Go to 'Enterprise Applications' in Microsoft Entra ID (formerly Azure AD), search for 'Azure Security Insights', and confirm it holds the correct Automation Contributor role.
Consult Microsoft Q&A for Advanced Configuration
Escalate the issue to Azure specialists if the Azure Security Insights application is missing or if permissions appear properly configured but fail to apply.
Need a Reliable Office Suite for Your Security Reports? Try WPS Office
While troubleshooting complex Azure Sentinel policies, you often need to document incidents and share technical reports. WPS Office provides a free, lightweight, and fully compatible alternative to Microsoft Office for creating professional documentation, spreadsheets, and presentations.
Frequently Asked Questions
What permissions are required to run a playbook in Microsoft Sentinel?
To run a playbook, you typically need the Microsoft Sentinel Responder role to manage the incident, and the Logic App Contributor (or Automation Contributor) role to trigger the logic app that acts as the playbook.
Why can't I find Azure Security Insights in Enterprise Applications?
Azure Security Insights is a first-party Microsoft application. If it does not appear in your Enterprise Applications list, it may not be registered in your tenant because Sentinel has not been locally deployed or initialized. You may need to register the resource provider manually via Azure Cloud Shell.
Do I need Sentinel deployed in my service provider tenant to manage client incidents?
No. Azure Lighthouse projects the customer's Sentinel workspace resources into your service provider tenant. You do not need Microsoft Sentinel deployed in your own tenant to view or manage their incidents, provided the Lighthouse delegation is configured correctly.
