// roles/azure · security

Microsoft Sentinel ResponderAzure built-in role

Microsoft Sentinel Responder

Role ID	`3e150937-b8fe-4cfb-8069-0eaf05ecd056`
Category	Security
Actions	27 (minus 4 NotActions)
Data actions	0

What it can do

Permission	What it allows
`Microsoft.SecurityInsights/*/read`	Any read operation on anything under Microsoft.SecurityInsights
`Microsoft.SecurityInsights/dataConnectorsCheckRequirements/action`	Check user authorization and license
`Microsoft.SecurityInsights/automationRules/*`	Every operation under Microsoft.SecurityInsights/automationRules
`Microsoft.SecurityInsights/cases/*`	Every operation under Microsoft.SecurityInsights/cases
`Microsoft.SecurityInsights/incidents/*`	Every operation under Microsoft.SecurityInsights/incidents
`Microsoft.SecurityInsights/entities/runPlaybook/action`	Run playbook on entity
`Microsoft.SecurityInsights/threatIntelligence/indicators/appendTags/action`	Append tags to Threat Intelligence Indicator
`Microsoft.SecurityInsights/threatIntelligence/indicators/query/action`	Query Threat Intelligence Indicators
`Microsoft.SecurityInsights/threatIntelligence/bulkTag/action`	Bulk Tags Threat Intelligence
`Microsoft.SecurityInsights/threatIntelligence/indicators/replaceTags/action`	Replace Tags of Threat Intelligence Indicator
`Microsoft.SecurityInsights/threatIntelligence/queryIndicators/action`	Query Threat Intelligence Indicators
`Microsoft.SecurityInsights/businessApplicationAgents/systems/undoAction/action`
`Microsoft.OperationalInsights/workspaces/analytics/query/action`	Search using new engine.
`Microsoft.OperationalInsights/workspaces/*/read`	Any read operation on anything under Microsoft.OperationalInsights/workspaces
`Microsoft.OperationalInsights/workspaces/dataSources/read`	Get data source under a workspace.
`Microsoft.OperationalInsights/workspaces/savedSearches/read`	Gets a saved search query.
`Microsoft.OperationsManagement/solutions/read`	Get existing OMS solution
`Microsoft.OperationalInsights/workspaces/query/read`	Run queries over the data in the workspace
`Microsoft.OperationalInsights/workspaces/query/*/read`	Any read operation on anything under Microsoft.OperationalInsights/workspaces/query
`Microsoft.OperationalInsights/querypacks/*/read`	Any read operation on anything under Microsoft.OperationalInsights/querypacks
`Microsoft.Insights/workbooks/read`	Read a workbook
`Microsoft.Insights/myworkbooks/read`
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Support/*`	Every operation under Microsoft.Support

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.SecurityInsights/cases/*/Delete`	Any delete operation on anything under Microsoft.SecurityInsights/cases
`Microsoft.SecurityInsights/incidents/*/Delete`	Any delete operation on anything under Microsoft.SecurityInsights/incidents
`Microsoft.SecurityInsights/ConfidentialWatchlists/*`	Every operation under Microsoft.SecurityInsights/ConfidentialWatchlists
`Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist/*`	Every operation under Microsoft.OperationalInsights/workspaces/query/ConfidentialWatchlist

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Microsoft Sentinel Responder" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Microsoft Sentinel Responder" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '3e150937-b8fe-4cfb-8069-0eaf05ecd056')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e150937-b8fe-4cfb-8069-0eaf05ecd056')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "3e150937-b8fe-4cfb-8069-0eaf05ecd056"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other security roles

App Compliance Automation Reader · 1 permission
Key Vault Crypto Service Release User · 1 permission
Security Assessment Contributor · 1 permission
Attestation Reader · 2 permissions
Key Vault Secrets User · 2 permissions
Attestation Contributor · 3 permissions
Locks Contributor · 3 permissions
Key Vault Certificate User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles