Microsoft Sentinel cannot invoke playbook – missing required permissions despite correct IAM

Question

Microsoft Sentinel cannot invoke playbook – missing required permissions despite correct IAM

Spencer Hauck 0

We are encountering a Microsoft Sentinel automation/playbook execution failure. Error: "Failed to trigger playbook – Missing required permissions for Microsoft Sentinel on the playbook resource" Details: - Playbook is Logic App (Consumption) - Trigger: When a Microsoft Sentinel incident is created - Same region as Sentinel workspace - System-assigned managed identity enabled - Workspace IAM: Microsoft Sentinel Responder assigned to Logic App MI - Logic App IAM: Contributor assigned to Microsoft Sentinel service principal - Manual "Run playbook" from Sentinel incident fails with the same error - Automation rule also fails / playbook is greyed out This persists after recreating the playbook and reapplying all permissions. This appears to be a Sentinel service authorization / playbook binding issue rather than IAM misconfiguration. Requesting assistance to reinitialize or repair the Sentinel playbook authorization for this workspace.

Sridevi Machavarapu 26,355 Reputation points Microsoft External Staff Moderator

2026-04-08T21:10:45.2433333+00:00
Hello Spencer Hauck,

Your understanding is correct this does not appear to be a typical IAM issue. Based on the behavior (playbook greyed out, manual run failing, and persisting after recreation), this points to a Sentinel authorization or binding issue.

Please check the following:

In the Logic App → Access Control (IAM) Ensure Microsoft Sentinel (Azure Security Insights) has Contributor or Logic App Contributor assigned at the Logic App scope

In Sentinel → Automation → Playbooks Remove the playbook and add it again, then wait a few minutes before testing

In the Logic App → Identity Turn System-assigned identity OFF and ON, then reassign the role

Note that assigning Microsoft Sentinel Responder to the Logic App managed identity does not impact triggering, since Sentinel uses its own service principal.

As per Microsoft Sentinel documentation, Sentinel runs playbooks using its service principal, which must have the required permissions on the Logic App. If these permissions are not properly applied or refreshed, the playbook may appear greyed out or fail to trigger.

Reference: https://dori-uw-1.kuma-moon.com/en-us/azure/sentinel/automation/run-playbooks?tabs=after-onboarding%2Cincidents%2Cazure%2Cincident-details-new