The isolate-virtual-machine Microsoft Sentinel playbook fails with HTTP 403 when it tries to change a lock-lab VM. What should the Azure security engineer fix?
Select an answer to reveal the explanation.
Short Explanation
403 means the playbook’s identity showed up without a badge. Give that managed identity an Azure role on the VM or resource group, and make sure Sentinel is allowed to attach the playbook.
Full Explanation
Sentinel playbooks that change Azure resources authenticate with a managed identity that must hold an appropriate Azure RBAC role on the virtual machine or its resource group. Sentinel also needs the rights required to attach and run the playbook. Removing the identity, blanket management-group Contributor for readers, or replacing the playbook with Security Copilot does not correctly authorize automation.