Microsoft Sentinel

Monitor the Health of your Microsoft Sentinel Automation Rules and Playbooks

4 September 2026Doc update+29 / −24 lines

In brief

The documentation now includes a table of common automation rule and playbook errors with recommended resolutions, and refreshes status descriptions and wording.

What Defender admins need to know

Administrators can use the updated guidance to interpret automation health statuses and troubleshoot failures.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Monitor the ~~health~~Health of your Microsoft Sentinel ~~automation rules~~Automation Rules and ~~playbooks~~Playbooks description: Use the SentinelHealth and AzureDiagnostics data tables to keep track of your automation rules' and playbooks' execution and performance. ms.author: monaberdugo author: mberdugo ms.reviewer: sshuster ms.topic: how-to ms.date: ~~08/20/2025~~07/01/2026 ms.service: microsoft-sentinel ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1016

#Customer intent: As a security analyst, I want to monitor the health of my automation rules and playbooks so that I can ensure the proper functioning and performance of my security orchestration and response operations.

The following types of automation health events are logged in the SentinelHealth table:

Automation rule run.: Logged whenever an automation rule's conditions are met, causing it to run. Besides the fields in the basic SentinelHealth table, these events ~~will~~ include extended properties unique to the running of automation rules, including a list of the playbooks called by the rule. The following sample query ~~will display~~displays these events:
```
SentinelHealth
| where OperationName == "Automation rule run"
```
Playbook was triggered.: Logged whenever a playbook is triggered on an incident manually from the portal or through the API. Besides the fields in the basic SentinelHealth table, these events ~~will~~ include extended properties unique to the manual triggering of playbooks. The following sample query ~~will display~~displays these events:
```
SentinelHealth
```

Statuses, errors and suggested steps

For the Automation rule run status, you ~~may~~might see the following statuses:

Success: ~~rule~~Rule executed successfully, triggering all actions.
Partial success: ~~rule~~Rule executed and triggered at least one action, but some actions failed.
Failure: ~~automation~~Automation rule ~~did not~~didn't run any action due to one of the following reasons:
- Conditions evaluation failed.
- Conditions met, but the first action failed.

For the Playbook was triggered status, you ~~may~~might see the following statuses:

Success: ~~playbook~~Playbook was triggered successfully.
Failure: ~~playbook could not~~Playbook couldn't be triggered.

Error descriptions and suggested actions

The following table describes common automation rule and playbook errors and recommended actions to resolve them.

Error description	Suggested actions
*Could not add task: <TaskName>.* Incident/alert was not found.	Make sure the incident/alert exists and try again.
*Could not trigger playbook: <PlaybookName>.* The subscription is disabled and marked as read-only. Playbooks in this subscription cannot be run until the subscription is re-enabled.	Re-enable the Azure subscription in which the playbook is located.
*Could not trigger playbook: <PlaybookName>.* The playbook was disabled.	Enable your playbook, in Microsoft Sentinel in the Active Playbooks tab under Automation, or in the Logic Apps resource page.
*Could not trigger playbook: <PlaybookName>.* Invalid template definition.	There is an error in the playbook definition. Go to the Logic Apps designer to fix the issues and save the playbook.
*Could not trigger playbook: <PlaybookName>.* Access control configuration restricts Microsoft Sentinel.	Logic Apps configurations allow restricting access to trigger the playbook. This restriction is in effect for this playbook. Remove this restriction so Microsoft Sentinel is not blocked. Restrict access by IP address range
*Could not trigger playbook: <PlaybookName>.* Microsoft Sentinel is missing permissions to run it.	Microsoft Sentinel requires permissions to run playbooks.
*Could not trigger playbook: <PlaybookName>.* Playbook wasn’t migrated to new permissions model. Grant Microsoft Sentinel permissions to run this playbook and resave the rule.	Grant Microsoft Sentinel permissions to run this playbook and resave the rule.
*Could not trigger playbook: <PlaybookName>.* Too many requests, exceeding workflow throttling limits.	The number of waiting workflow runs has exceeded the maximum allowed limit. Try increasing the value of `'maximumWaitingRuns'` in trigger concurrency configuration.
*Could not trigger playbook: <PlaybookName>.* Too many requests, exceeding throttling limits.	Learn more about throttling limits.
*Could not trigger playbook: <PlaybookName>.* Access was forbidden. Managed identity is missing configuration or Logic Apps network restriction has been set.	If the playbook uses managed identity, make sure the managed identity was assigned with permissions. The playbook may have network restriction rules preventing it from being triggered as they block Microsoft Sentinel service.
*Could not trigger playbook: <PlaybookName>.* The subscription or resource group was locked.	Remove the lock to allow Microsoft Sentinel trigger playbooks in the locked scope. Learn more about locked resources.
*Could not trigger playbook: <PlaybookName>.* Caller is missing required playbook-triggering permissions on playbook, or Microsoft Sentinel is missing permissions on it.	The user trying to trigger the playbook on demand is missing Logic Apps Contributor role on the playbook or to trigger the playbook. Restrict access to a logic app by IP address range
*Could not trigger playbook: <PlaybookName>.* Invalid credentials in connection.	Check the credentials your connection is using in the API connections service in the Azure portal.
*Could not trigger playbook: <PlaybookName>.* Playbook ARM ID is not valid.

Turn on Azure Logic Apps diagnostics

For each playbook you ~~are~~'re interested in monitoring, enable Log Analytics for your logic app. Make sure to select Send to Log Analytics workspace as your log destination, and choose your Microsoft Sentinel workspace.

Correlate Microsoft Sentinel and Azure Logic Apps logs

playbookRunStatus


See more information on the following items used in the preceding examples,examples in the Kusto documentation:

- [***where*** operator](/kusto/query/where-operator?view=microsoft-sentinel&preserve-view=true)
- [***mv-expand*** operator](/kusto/query/mv-expand-operator?view=microsoft-sentinel&preserve-view=true)
- [***extend*** operator](/kusto/query/extend-operator?view=microsoft-sentinel&preserve-view=true)

## Use the health monitoring workbook

The **Automation health** workbook helps you visualize your health data, as well as the correlation between the two types ofMicrosoft Sentinel *SentinelHealth* logs that we just mentioned.and Azure Logic Apps *AzureDiagnostics* logs. The **Automation health** workbook includes the following displays:

- Automation rule health and details
- Playbook trigger health and details

:::image type="content" source="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-run-list.png" alt-text="Screenshot shows a list of runs of the chosen playbook.":::

Select a particular run to see the results of the actions in the playbook.that playbook run.

:::image type="content" source="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-runs.png" alt-text="Screenshot shows the actions taken in a given run of thisthe selected playbook." lightbox="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-runs.png":::

## Next stepsRelated content

- Learn about [auditing[Auditing and health monitoring in Microsoft Sentinel](health-audit.md).
- [Turn on auditing and health monitoring](enable-monitoring.md) in Microsoft Sentinel.
- [Monitor the health of your data connectors](monitor-data-connector-health.md).
- [Monitor the health and integrity of your analytics rules](monitor-analytics-rule-integrity.md).
- See more information about the [*SentinelHealth*][Microsoft Sentinel health tables reference](health-table-reference.md)
and [*SentinelAudit*]- [Microsoft Sentinel audit tables reference](audit-table-reference.md)
table schemas.

@@ -1,12 +1,14 @@ ----title: Monitor the health of your Microsoft Sentinel automation rules and playbooks+title: Monitor the Health of your Microsoft Sentinel Automation Rules and Playbooks description: Use the SentinelHealth and AzureDiagnostics data tables to keep track of your automation rules' and playbooks' execution and performance. ms.author: monaberdugo author: mberdugo ms.reviewer: sshuster ms.topic: how-to-ms.date: 08/20/2025+ms.date: 07/01/2026 ms.service: microsoft-sentinel+ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1016   #Customer intent: As a security analyst, I want to monitor the health of my automation rules and playbooks so that I can ensure the proper functioning and performance of my security orchestration and response operations.@@ -31,14 +33,14 @@ Once the health feature is turned on, the *SentinelHealth* data table is created  The following types of automation health events are logged in the *SentinelHealth* table: -- **Automation rule run**. Logged whenever an automation rule's conditions are met, causing it to run. Besides the fields in the basic *SentinelHealth* table, these events will include [extended properties unique to the running of automation rules](health-table-reference.md#automation-rules), including a list of the playbooks called by the rule. The following sample query will display these events:+- **Automation rule run**: Logged whenever an automation rule's conditions are met, causing it to run. Besides the fields in the basic *SentinelHealth* table, these events include [extended properties unique to the running of automation rules](health-table-reference.md#automation-rules), including a list of the playbooks called by the rule. The following sample query displays these events:      ```kusto     SentinelHealth     | where OperationName == "Automation rule run"     ``` -- **Playbook was triggered**. Logged whenever a playbook is triggered on an incident manually from the portal or through the API. Besides the fields in the basic *SentinelHealth* table, these events will include [extended properties unique to the manual triggering of playbooks](health-table-reference.md#playbooks). The following sample query will display these events:+- **Playbook was triggered**: Logged whenever a playbook is triggered on an incident manually from the portal or through the API. Besides the fields in the basic *SentinelHealth* table, these events include [extended properties unique to the manual triggering of playbooks](health-table-reference.md#playbooks). The following sample query displays these events:      ```kusto     SentinelHealth@@ -49,28 +51,29 @@ For more information, see [SentinelHealth table columns schema](health-table-ref  ### Statuses, errors and suggested steps -For the **Automation rule run** status, you may see the following statuses:+For the **Automation rule run** status, you might see the following statuses: -- **Success**: rule executed successfully, triggering all actions.-- **Partial success**: rule executed and triggered at least one action, but some actions failed.-- **Failure**: automation rule did not run any action due to one of the following reasons:+- **Success**: Rule executed successfully, triggering all actions.+- **Partial success**: Rule executed and triggered at least one action, but some actions failed.+- **Failure**: Automation rule didn't run any action due to one of the following reasons: -    - Conditions evaluation failed.-    - Conditions met, but the first action failed.+  - Conditions evaluation failed.+  - Conditions met, but the first action failed. -For the **Playbook was triggered** status, you may see the following statuses:+For the **Playbook was triggered** status, you might see the following statuses: -- **Success**: playbook was triggered successfully.-- **Failure**: playbook could not be triggered.+- **Success**: Playbook was triggered successfully.+- **Failure**: Playbook couldn't be triggered.      > [!NOTE]-    >      > **Success** means only that the automation rule successfully triggered a playbook. It doesn't tell you when the playbook started or ended, the results of the actions in the playbook, or the final result of the playbook.     >     > To find this information, query the Logic Apps diagnostics logs. For more information, see [Get the complete automation picture](#get-the-complete-automation-picture).  ### Error descriptions and suggested actions +The following table describes common automation rule and playbook errors and recommended actions to resolve them.+ | Error description                 | Suggested actions                         | | --------------------------------- | ----------------------------------------- | | **Could not add task: *\<TaskName>*.**<br>Incident/alert was not found. | Make sure the incident/alert exists and try again. |@@ -83,14 +86,14 @@ For the **Playbook was triggered** status, you may see the following statuses: | **Could not trigger playbook: *\<PlaybookName>*.**<br>The subscription is disabled and marked as read-only. Playbooks in this subscription cannot be run until the subscription is re-enabled. | Re-enable the Azure subscription in which the playbook is located. | | **Could not trigger playbook: *\<PlaybookName>*.**<br>The playbook was disabled. | Enable your playbook, in Microsoft Sentinel in the Active Playbooks tab under Automation, or in the Logic Apps resource page. | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Invalid template definition. | There is an error in the playbook definition. Go to the Logic Apps designer to fix the issues and save the playbook. |-| **Could not trigger playbook: *\<PlaybookName>*.**<br>Access control configuration restricts Microsoft Sentinel. | Logic Apps configurations allow restricting access to trigger the playbook. This restriction is in effect for this playbook. Remove this restriction so Microsoft Sentinel is not blocked. [Learn more](/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#restrict-access-by-ip-address-range) |+| **Could not trigger playbook: *\<PlaybookName>*.**<br>Access control configuration restricts Microsoft Sentinel. | Logic Apps configurations allow restricting access to trigger the playbook. This restriction is in effect for this playbook. Remove this restriction so Microsoft Sentinel is not blocked. [Restrict access by IP address range](/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#restrict-access-by-ip-address-range) | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Microsoft Sentinel is missing permissions to run it. | Microsoft Sentinel requires [permissions to run playbooks](tutorial-respond-threats-playbook.md?tabs=LAC#respond-to-incidents). | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Playbook wasn’t migrated to new permissions model. Grant Microsoft Sentinel permissions to run this playbook and resave the rule. | Grant Microsoft Sentinel [permissions to run this playbook](tutorial-respond-threats-playbook.md?tabs=LAC#respond-to-incidents) and resave the rule. | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Too many requests, exceeding workflow throttling limits. | The number of waiting workflow runs has exceeded the maximum allowed limit. Try increasing the value of `'maximumWaitingRuns'` in [trigger concurrency configuration](/azure/logic-apps/logic-apps-workflow-actions-triggers#change-waiting-runs-limit). | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Too many requests, exceeding throttling limits. | Learn more about [throttling limits](/azure/azure-resource-manager/management/request-limits-and-throttling). | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Access was forbidden. Managed identity is missing configuration or Logic Apps network restriction has been set. | If the playbook uses managed identity, [make sure the managed identity was assigned with permissions](authenticate-playbooks-to-sentinel.md#authenticate-with-managed-identity). The playbook may have network restriction rules preventing it from being triggered as they block Microsoft Sentinel service. | | **Could not trigger playbook: *\<PlaybookName>*.**<br>The subscription or resource group was locked. | Remove the lock to allow Microsoft Sentinel trigger playbooks in the locked scope. Learn more about [locked resources](/azure/azure-resource-manager/management/lock-resources?tabs=json). |-| **Could not trigger playbook: *\<PlaybookName>*.**<br>Caller is missing required playbook-triggering permissions on playbook, or Microsoft Sentinel is missing permissions on it. | The user trying to trigger the playbook on demand is missing Logic Apps Contributor role on the playbook or to trigger the playbook. [Learn more](/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#restrict-access-by-ip-address-range) |+| **Could not trigger playbook: *\<PlaybookName>*.**<br>Caller is missing required playbook-triggering permissions on playbook, or Microsoft Sentinel is missing permissions on it. | The user trying to trigger the playbook on demand is missing Logic Apps Contributor role on the playbook or to trigger the playbook. [Restrict access to a logic app by IP address range](/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#restrict-access-by-ip-address-range) | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Invalid credentials in connection. | [Check the credentials your connection is using](authenticate-playbooks-to-sentinel.md#manage-your-api-connections) in the **API connections** service in the Azure portal. | | **Could not trigger playbook: *\<PlaybookName>*.**<br>Playbook ARM ID is not valid. |  | @@ -107,7 +110,7 @@ These added events provide additional insights into the actions being taken in y  ### Turn on Azure Logic Apps diagnostics -For each playbook you are interested in monitoring, [enable Log Analytics for your logic app](/azure/logic-apps/monitor-workflows-collect-diagnostic-data). Make sure to select **Send to Log Analytics workspace** as your log destination, and choose your Microsoft Sentinel workspace.+For each playbook you're interested in monitoring, [enable Log Analytics for your logic app](/azure/logic-apps/monitor-workflows-collect-diagnostic-data). Make sure to select **Send to Log Analytics workspace** as your log destination, and choose your Microsoft Sentinel workspace.  ### Correlate Microsoft Sentinel and Azure Logic Apps logs @@ -136,7 +139,8 @@ SentinelHealth     playbookRunStatus ``` -See more information on the following items used in the preceding examples, in the Kusto documentation:+See more information on the following items used in the preceding examples in the Kusto documentation:+ - [***where*** operator](/kusto/query/where-operator?view=microsoft-sentinel&preserve-view=true) - [***mv-expand*** operator](/kusto/query/mv-expand-operator?view=microsoft-sentinel&preserve-view=true) - [***extend*** operator](/kusto/query/extend-operator?view=microsoft-sentinel&preserve-view=true)@@ -148,7 +152,7 @@ See more information on the following items used in the preceding examples, in t  ## Use the health monitoring workbook -The **Automation health** workbook helps you visualize your health data, as well as the correlation between the two types of logs that we just mentioned. The workbook includes the following displays:+The **Automation health** workbook helps you visualize your health data, as well as the correlation between Microsoft Sentinel *SentinelHealth* logs and Azure Logic Apps *AzureDiagnostics* logs. The **Automation health** workbook includes the following displays:  - Automation rule health and details - Playbook trigger health and details@@ -167,14 +171,15 @@ Select a playbook to see the list of its runs in the drill-down chart below.  :::image type="content" source="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-run-list.png" alt-text="Screenshot shows a list of runs of the chosen playbook."::: -Select a particular run to see the results of the actions in the playbook.+Select a particular run to see the results of the actions in that playbook run. -:::image type="content" source="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-runs.png" alt-text="Screenshot shows the actions taken in a given run of this playbook." lightbox="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-runs.png":::+:::image type="content" source="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-runs.png" alt-text="Screenshot shows the actions taken in a given run of the selected playbook." lightbox="media/monitor-automation-health/automation-health-monitoring-workbook-playbook-runs.png"::: -## Next steps+## Related content -- Learn about [auditing and health monitoring in Microsoft Sentinel](health-audit.md).+- [Auditing and health monitoring in Microsoft Sentinel](health-audit.md). - [Turn on auditing and health monitoring](enable-monitoring.md) in Microsoft Sentinel. - [Monitor the health of your data connectors](monitor-data-connector-health.md). - [Monitor the health and integrity of your analytics rules](monitor-analytics-rule-integrity.md).-- See more information about the [*SentinelHealth*](health-table-reference.md) and [*SentinelAudit*](audit-table-reference.md) table schemas.+- [Microsoft Sentinel health tables reference](health-table-reference.md)+- [Microsoft Sentinel audit tables reference](audit-table-reference.md)