Nov 27 2023 08:50 AM
We manage several Sentinel workspaces from different subscriptions using multi-tenant workspace manager. We have several playbooks developed and existing in resource groups associated with these separate workspaces although the resource groups have been created in our central workspace. The issue is that when we go into the automation blade and view available playbooks, we are not able to see these subscriptions or playbooks. We normally can view all the subs connected to the workspace manager but now we can only see our dev subscription, not even the central. Because of this we can't see any of our other RGs or playbooks from within Sentinel.
Several automation rules are in place to call these playbooks and all this is still working so Sentinel is still able to access and run these playbooks. We can also see them through the Azure portal if we go to the individual RGs. Also, we are able to create new playbooks and deploy them to the RGs through the automation creation wizard. Is there a setting that got misconfigured that is causing us to not be able to see the playbooks?
Nov 28 2023 09:58 PM
@MikeHemming can you check to see if your access is still functioning
Do you still have at least the Microsoft Sentinel Contributor assigned to your account across all workspaces?
Dec 01 2023 01:31 PM
Dec 05 2023 10:46 AM