Caller is missing required playbook triggering permissions on playbook resource

Question

I have created a custom playbook but I get the error:

---

Failed to trigger playbook

Caller is missing required playbook triggering permissions on playbook resource '/subscriptions/8a6d2938-80eb-43bf-9a78-1427a031ab90/resourceGroups/mms-seau/providers/Microsoft.Logic/workflows/ChatGPT3-Playbook', or Microsoft Sentinel is missing required permissions to verify the caller has permissions

---

When I attempt to manually execute it using incident actions.

Answer 1

go to sentinel -> settings -> playbook permissions → configure permissions → add resource group chatGPT3-playbook belongs to

Answer 2

@Robert D. Crane Apologies for the delay in reviewing this post, based on the error details you provided in the query, please check the below document for the necessary permission given on Logic App and sentinel (check ‘Important’ section)
Use playbooks with automation rules in Microsoft Sentinel | Microsoft Learn

You must have owner permissions on any resource group to which you want to grant Microsoft Sentinel permissions, and you must have the Logic App Contributor role on any resource group containing playbooks you want to run.

Also, refer to this https://learn.microsoft.com/en-us/azure/sentinel/roles Roles and permissions required for Microsoft Sentinel.

Let me know if you have any further questions, feel free to post back or If the issue still persists, lets connect offline to troubleshoot this further.

You can reach me via sending an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:Givary"

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

I have a slightly different way to work out these permissions:

1. Go through your entire logic app and identify all logic app functions that use a user identity and/or a managed identity.
2. Assign the Sentinel Incident Responder role to your logic app - this assumes you're just running playbooks manually from within Sentinel.
   1. make sure all identities in your logic app are assigned to this role.

Troubleshooting:

• start from scratch - create a logic app with 2 operators: Get Incidents, and Send Email. Apply the Incident Responder role as shown above.
  • once this works, begin adding additional logic and repeat the testing/validation step.

Answer 4

@Robert D. Crane

Thank you for your post and I apologize for the delayed response!

Error Message:

Caller is missing required playbook triggering permissions on playbook resource '/subscriptions/..../resourceGroups/.../providers/Microsoft.Logic/workflows/...', or Microsoft Sentinel is missing required permissions to verify the caller has permissions.

From your issue, I understand that you created a custom Sentinel Playbook and when trying to manually run your Playbook through the Sentinel Incident, you're receiving the error message above.

I reproduced your issue and will share some troubleshooting steps below to hopefully point you in the right direction.

Note: If you're still having issues, please feel free to reach out to myself or Givary using the azcommunity email

---

Findings:

From your previous comments, I understand that you added your Resource Group (mms-seau) to the Sentinel Playbook Permissions Setting, and also confirmed the Microsoft Sentinel Responder role assignment was inherited.

Troubleshooting:

From your error, this still looks like a Permissions issue, so can you confirm the following:

1. From your Resource Group (mms-seau), Select Access Control (IAM), confirm your resource group has the Microsoft Sentinel Automation Contributor role assigned to Azure Security Insights. Additionally, make sure that your user has the Logic App Contributor and Owner role assigned.
   1. Note: You yourself must have Owner permissions on any resource group to which you want to grant Microsoft Sentinel permissions, and you must have the Logic App Contributor role on any resource group containing playbooks you want to run. To run a playbook based on the incident trigger, whether manually or from an automation rule, Microsoft Sentinel uses a service account specifically authorized to do so. This account must be granted explicit permissions (taking the form of the Microsoft Sentinel Automation Contributor role) on the resource group where the playbook resides.
2. If your Resource Group has the correct permissions, we can try to see if there are any issues when creating a Test Automation rule. If a playbook appears "grayed out" in the drop-down list, it means Sentinel doesn't have permission to that playbook's resource group. To resolve the issue, you'll have to click the Manage playbook permissions link to assign permissions.

I hope this helps!

---

If you're still having issue, please let us know and we'd be happy to continue working with you on this issue. Thank you for your time and patience throughout this issue.