Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Authenticate Playbooks To Sentinel

4 September 2026Doc update+16 / −19 lines

In brief

The article now uses clearer terminology for Azure Logic Apps connections, managed identities, service principals, and application credentials, with updated headings, links, and screenshot descriptions.

What Defender admins need to know

Administrators have more precise guidance when configuring Microsoft Sentinel playbook authentication; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

#Customer intent: As a security analyst, I want to authenticate playbooks to Microsoft Sentinel so that I can automate and orchestrate security tasks efficiently.

Azure Logic Apps must connect separately and authenticate independently to each resource, of each type, that it interacts with, including to Microsoft Sentinel itself. Logic Apps uses specialized connectors for this purpose, with each resource type having its own connector.

This article describes the types of connectionsconnection and authentication types supported by the Microsoft Sentinel connector for theAzure Logic Apps Microsoft Sentinel connector.Apps. Playbooks can use supported authentication methods to interact with Microsoft Sentinel and access your Microsoft Sentinel data.

Prerequisites

To give a managed identity access to other resources, like your Microsoft Sentinel workspace, your signed-in user must have a role with permissions to write role assignments, such as Owner or User Access Administrator of the Microsoft Sentinel workspace.

Authentication methods for Microsoft Sentinel playbooks

The Microsoft Sentinel connector in Logic Apps, and its component triggers and actions, can operate on behalf of any identity that has the necessary permissions (read and/or write) on the relevant workspace. The connector supports multiple identity types:

Roles Use triggers Use "Read" actions Use "Write" actions
Microsoft Sentinel Reader ✓ ✓ -
Microsoft Sentinel Microsoft Sentinel Responder/Microsoft Sentinel Contributor ✓ ✓ ✓

For more information,role definitions, see Roles and permissions in Microsoft Sentinel and. For required setup before using playbooks, see Microsoft Sentinel playbook prerequisites.

Authenticate with a managed identity

Authenticating as a managed identity allows you to give permissions directly to the playbook, which is a Logic App workflow resource. Microsoft Sentinel connector actions taken by the playbook then operate on the playbook's behalf, as if it were an independent object with its own permissions on Microsoft Sentinel. 

Your logic app can now use the system-assigned identity, which is registered with Microsoft Entra ID and is represented by an object ID.

  1. Use the following steps to grant thatthe logic app's system-assigned managed identity with access to your Microsoft Sentinel workspace:

    1. From the Microsoft Sentinel menu, select Settings.
    2. Select the Workspace settings tab. From the workspace menu, select Access control (IAM).

    For more information, see Give identity access to resources.

  2. Enable the managed identity authentication method in the Microsoft Sentinel connector for Azure Logic Apps connector:Apps:

    1. In the Logic Apps designer, add a Microsoft Sentinel Logic Apps connector step. If the connector is already enabled for an existing connection, select the Change connection link. For example:

    2. Select Create to finish creating your connection.

Authenticate as a service principal (Microsoft Entra application)

A service principal is the identity object created in Microsoft Entra ID for a registered application, allowing the application to authenticate and access resources on its own behalf. Create a service principal by registering a Microsoft Entra application. We recommend that you use a registered application as the connector's identity instead of a user account.

To use your own application with the Microsoft Sentinel connector: 

    By default, Microsoft Entra applications aren't displayed in the available options. To find your application, search for the name and select it.

  1. Use the app credentialsregistered application's tenant ID, client ID, and client secret to authenticate to the Microsoft Sentinel connector in Logic Apps.

    1. In the Logic Apps designer, add a Microsoft Sentinel Logic Apps connector step.

    2. If the connector is already enabled for an existing connection, select the Change connection link. For example:

      Screenshot of the Microsoft Sentinel connector pane with the Change connection link visible for an existing connection.

    3. In the resulting list of connections, select Add new, and then select Connect with Service Principal. For example:

  2. In the Logic Apps designer, add a Microsoft Sentinel Logic Apps connector step. If the connector is already enabled for an existing connection, select the Change connection link. For example:

    Screenshot of the Microsoft Sentinel connector configuration in Logic Apps with the Change connection link for updating the connection authentication.

  3. In the resulting list of connections, select Add new, and then select Sign in.

  • In the Azure portal, search for API connections. Locate the API connection for your playbook using the following data:

    • Display name: The friendly name you give the connection every time you create one.
    • Status: The API connection's status.
    • Resource group: API connections for Microsoft playbooks are created in the playbook (Azure Logic Apps) resource's resource group.

  • In the Azure portal, view all resources and filter the view by Type = API connector. This method allows you to select, tag, and delete multiple connections at once.

Related content

For more information, see: