No names in dropdown when assigning sentinel incidents

Question

Soumya Banerjee 126

Unable to see any names when trying to assign incidents. what changes needs to be done to be able to see list of users

Answer 1

Givary-MSFT 22,111 Microsoft Employee

Thank you for reaching out to us.

Does your account has required Sentinel RBAC permissions to assign incidents ?

Let me know if you have any questions.

Soumya Banerjee 126 Reputation points

2022-03-31T08:11:15.327+00:00

@GirishVaryani

Ys I have Microsoft Sentinel Contributor + Logic App contributor
Givary-MSFT 22,111 Reputation points Microsoft Employee

2022-03-31T13:13:09.597+00:00

@Soumya Banerjee

Where do you have these RBAC permissions defined ? On the Resource Group ?

Steps:

Identify the resource group of the workspace connected to the sentinel.

Go to the resource group where the sentinel workspace is installed/configurated.

Open the resource group for the sentinel log analytics workspace.

In the resource group, go to 'Access control (IAM)' and then select '+Add' > 'Add role assignment.'

On next page, select the 'Microsoft Sentinel Contributor', click next > '+Select members' > Add your user.

Click Review + assign.

Logoff and logon, let me know the results, else we can connect offline to check on this.
Givary-MSFT 22,111 Reputation points Microsoft Employee

2022-04-01T07:04:44.157+00:00

@Soumya Banerjee

Just wanted to check if you have tried the above steps or should we connect offline to check the issue.
Soumya Banerjee 126 Reputation points

2022-04-04T06:58:40.76+00:00

I had to to add directory.read .
Givary-MSFT 22,111 Reputation points Microsoft Employee

2022-04-04T07:20:10.283+00:00

@Soumya Banerjee

Thanks for the update on this issue, this would definitely help other community members having a similar issue.

1 answer