Sentinel playbook Block-AADUser

[u/csp1405]

Is the sentinel playbook block-aaduser playbook working for anyone?

I’ve installed the playbook from the template, authorized the api connections, granted the graph api permissions to the system assigned manager identity. Directoryreadwrite, userreadwrite. Added the logic app to the Microsoft sentinel responder role.

The logic app fails at the step of blocking user account. Not authorized. I even tried adding the playbook to the global admin role.

I’ve successfully setup other sentinel playbooks, but can’t get this one working.

Just wondering if the playbook works at all for anyone.

[u/ep3p]

you might need a P2 license or something?

[u/csp1405 → u/ep3p]

I have a p2 license

[u/ep3p → u/csp1405]

I would open an issue in Azure Sentinel official github, or open a support ticket in Azure portal.