Automated Automation Rule Deployment - Stuck with Service Principle Permissions via Lighthouse
(Sorry for the tag, i couldnt find somthing closer to Microsoft Sentinel via Service Principal through Lighthouse)
Hi, I am trying to create a product where we essentially automatically deploy resources to customer environments for MSSP support. One of these items is an Automation Rule that triggers a logic app. I can deploy analytics rules, logic apps, workbooks, hunting queries absolutely fine, but when it comes to automation rules, there is some weird permission niche i cant seem to get.
Ive given my service principle the following permissions to try and test via lighthouse: Contributor
Logic App Contributor
Microsoft Sentinel Contributor
Microsoft Sentinel Automation Contributor
Microsoft Sentinel Playbook Operator
Microsoft Sentinel Responder
Yet every time i deploy with terraform i get the following:
The service principal does not have permission to trigger the Logic App.\nERROR:root:Please ensure the service principal has the '**Microsoft Sentinel Responder'** permissions.
Yet i do have that permission. I have also tested with just contributor access on my own dev environment where the service principle resides, and found it works just with contributor on the subscription.
Another note, i also have gone to my logic-app and authenticated the connection against my tenant id and service principle, so this should also not be an issue.
I wanted to ask if this is a bug that can be fixed, or if its an error with the back end permissions handling specifically for automation rules. If so, please can this be amended, so i can deploy automation rules using my lighthouse enabled service principle.
If so, the only other option is to have a service principle reside directly on a customer tenancy, in which case, what is the point of Lighthouse? I also wanted to query if user accounts have different permissions than service principles, as when i create automation rules as a user via lighthouse, there are no issues at all.
Cheers.