Sentinel as IaC with Terraform

Question

Hi,

Trying to instantiate Sentinel using Terraform. Should be straightforward, create a resource group (azurerm_resource_group), log analytics workspace (azurerm_log_analytics_workspace), onboarding Sentinel (azurerm_sentinel_log_analytics_workspace_onboarding), then enabling data connectors of my choice (for starters azurerm_sentinel_data_connector_microsoft_defender_advanced_threat_protection and azurerm_sentinel_data_connector_office_365).

I’ve tried this last Friday and it all worked, although had issues with the 365 Defender connector as described here https://github.com/Azure/SimuLand/issues/23 Everything else go created, also the data connector for Office 365. Deleted the Office365 as it was a weekend planning to play around with it on Monday. Today realized that I’m not able to enable the Office 365 connector with the SAME code although it worked on last Friday …

rror: creating Data Connector: (Name "office_365" / Workspace Name "foo-bar-sentinel" / Resource Group "foo-bar"): securityinsight.DataConnectorsClient#CreateOrUpdate: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="Unauthorized" Message="Access

denied"

│

│ with module.office_365.azurerm_sentinel_data_connector_office_365.office_365,

│ on modules\DataConnectors\Office365\main.tf line 1, in resource "azurerm_sentinel_data_connector_office_365" "office_365":

│ 1: resource "azurerm_sentinel_data_connector_office_365" "office_365" {

This can’t be a permission issue because I’m using the exact same principal (Contributor role on the subscription).

Anyone ?

PS. here's a screen shot from last Friday showing the connector as enabled !

Answer 1

Hello Forum.

I'm going to the same predicament here and I wander if you would be kind enough to please post the terraform script to deploy Azure Sentinel (RG, Work Group and Sentinel and the connectors)

I would really appreciate it.

Thank you.