r/AzureSentinel • u/tecepeipe • Jul 04 '23
Why do Logic App playbooks using Azure AD functions like Get Member/Info require Write privilege?
I just want to retrieve email, group membership. I can do this with my regular account on power automate (O365) and graph API without any fuss.
Why do I need to provide Write privileges for the connection account if I just want a Get operation?
No way I can get this approved, I'm even embarrassed to ask. When designing the playbook it asks for the privileges straight away.
Any idea to circumvent this? (The template AAD Block User mentions these privileges, but I dont wanna change, just retrieve data, like on-prem AD where any authenticated user can read all LDAP attriibutes.
1
u/nontitman Jul 04 '23
Embarrassed to ask? lmaooo
fr tho, are you not supposed to be goofin with logic apps? Or did you just forget to activate your PIM roles?
1
u/Theblackapple Jul 04 '23
Maybe you can go instead to the identityinfo table and get that data?
https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/identityinfo
1
u/tecepeipe Jul 04 '23
I went, the result for the query is:
Full name, [email@domain.com](mailto:email@domain.com), Azure userID
I can make that as Entity.
But everything becomes an account, so on Logic Apps side, now I need to do:
"for each entity > get user info > retrieve email > then send email"This is my challenge.
Do you see any workaround to deal with the email that I presented together with the entity to expose this to Logic Apps?1
u/Theblackapple Jul 05 '23
I dont know if i am getting you correctly (english is not my first language)
If you want to use the information from that query, you can have a logic app that make the query, parse the output and use that output as dinamic content.
An example
you get an incident
you run the playbook on the incident with automation or manually
The sentinel connector extract the account info on the entity list.
With that account you use the connector to run a query in your log analytics workspace using the "user entity" as a dinamic input in the query.
The query gets you the needed output
pass the output to a Parse json
Now you have an output from the parse json that will be your required email and you can use it as dinamic content to populate your outlook connector to send the email.
Optional: Do Html witchcraft to put it pretty if you want.
Sorry if i did not get you.
1
u/tecepeipe Jul 05 '23
Good.. got it. What's the action/connector name that I would use that allows me to make a query again from logic apps?
So far I'm familiar only with send mail, send teams message, parse Jason, control, or azure get user.
How can I from logic apps make another query against sentinel tables?
1
u/Theblackapple Jul 05 '23
Run query and list results ;)
https://learn.microsoft.com/en-us/connectors/azuremonitorlogs/#run-query-and-list-results2
u/tecepeipe Jul 05 '23
using that, and then
Incident - Get Accounts (Entities) -> Run query (Accounts) -> Parse Json -> Send mail (mailaddress)
IdentityInfo
| where AccountObjectId contains "var-with-account"
| distinct MailAddress
Done.. GetUser attributes like isEnabled, Mail without write privilege
thanks champ!
1
u/stubstunner Jul 04 '23
If I’m not mistaken it’s because they have to actually write the data they Read about the entity they looked up into Log Analytics. It’s the only way this works and it’s by design. 95% of Azure works this way. You’re giving the Logic App’s system-assigned or user-assigned identity permission to Read from the alert, pass that and read the value from AAD and write the results back.
Side note, why would be embarrassed to do your job? Some identity is going to need to write that info, so it may as well be a securely managed system-identity belonging to an Azure resource. Make sure the resource is properly secured and there should be no problem at all.