How to deploy playbooks in a customer tenant using Azure Lighthouse

Question

I am attempting to deploy a playbook that will automatically send an email to the security team when a certain incident has been triggered. I run into a an error when trying publish the playbook that states that "caller is missing required playbook triggering permissions on playbook resource". I am unsure why I am still unable to publish the playbook as I have all of the correct permissions delegated to me through Azure lighthouse.

Answer 1

Hi Ethan,

I would first verify that the owner of the resource group where you're running your Sentinel/lighthouse instance can create playbooks.

If that works then I'd verify that you've been given the automation role.

If that doesn't work I'd verify that the playbook you're trying to create is in the same resource group as the Sentinel/lighthouse instance.

Good luck.

Reference:

https://learn.microsoft.com/en-us/azure/sentinel/roles