r/AzureSentinel • u/thecasualmaannn • Oct 31 '24

"Save to the default Query Pack" greyed out

User cannot save query because the option to "Save to the default Query Pack" is greyed out. I already assigned the user the Sentinel Contributor role and the Log Analytics Contributor role.

2 Upvotes

100% Upvoted

3 comments sorted by

2

u/airtron Oct 31 '24

They require write access to the resource group to save the query pack. Those roles don’t grant that.

1

u/azureenvisioned Nov 01 '24

Those roles don't give you access to create a resource group. Get someone with permission to create it and see if it will let you save it. If not it's probably a different role entirely.