Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Create and manage Microsoft Sentinel playbooks

4 September 2026Doc update+15 / −17 lines

In brief

The article now clarifies prerequisites, authentication guidance, trigger examples, output descriptions, and links for creating analytics rules. Metadata and wording were also refreshed.

What Defender admins need to know

Administrators have clearer setup and troubleshooting guidance when creating or managing playbooks; no configuration change is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Create and manage Microsoft Sentinel playbooks

Playbooks are collections of procedures that can be run from Microsoft Sentinel in response to an entire incident, to an individual alert, or to a specific entity. A playbook can help automate and orchestrate your response and can be attached to an automation rule to run automatically when specific alerts are generated or when incidents are created or updated. Playbooks can also be run manually on-demand on specific incidents, alerts, or entities.

This article describes how to create and manage Microsoft Sentinel playbooks. Before you begin, make sure you meet the playbook prerequisites, including an Azure subscription and the required Logic App Azure roles. You can later attach these playbooks to analytics rules or automation rules, or run them manually on specific incidents, alerts, or entities.

[!INCLUDE unified-soc-preview]

Prerequisites

Before you create or manage playbooks, make sure you meet the following prerequisites:

In each action, when you select inside a field, you get the following options:

Dynamic content: Entity playbooks with no incident ID

Playbooks created with the Microsoft Sentinel entity trigger often use the Incident ARM ID field, which contains the Azure Resource Manager identifier for the associated incident. This field is used, for example, to update an incident after taking action on the entity. If such a playbook is triggered in a scenario that's unconnected to an incident, such as when threat hunting, there's no incident ID to populate this field. Instead, the field is populated with a null value. As a result, the playbook might fail to run to completion.

To prevent this failure, we recommend that you create a condition that checks for a value in the incident ID field before the workflow takes any other actions. You can prescribe a different set of actions to take if the field has a null value, due to the playbook not being run from an incident.

Dynamic content: Work with custom details

In the Microsoft Sentinel incident trigger, the Alert custom details output is an array of JSON objects where each represents a custom detail, as described in Surface custom details in alerts. Custom details are key-value pairs that let you surface information from events in the alert so they can be represented, tracked, and analyzed as part of the incident.

This field in the alert is customizable, so its schema depends on the type of event that is surfaced. To generate the schema that determines how to parse the custom details output, provide the data from an instance of this event:

  1. On the Microsoft Sentinel workspace menu, under Configuration, select Analytics.

  2. Follow the steps to create or open an existing create a scheduled analytics rule or create an NRT analytics rule.

  3. On the Set rule logic tab, expand the Custom details section, for example:

Related content

After you create your playbook, attach it to rules to be triggered by events in your environment, or run your playbooks manually on specific incidents, alerts, or entities.

For more information, see: