Microsoft Sentinel Playbook - "Unable to initialize operation" and Sentinel actions not loading in Logic Apps

Joshua Adeleye 20 Reputation points
2026-08-01T21:51:43.31+00:00

Screenshot 2026-08-02 142113

Screenshot 2026-08-01 222951Screenshot 2026-08-02 142550

Hi everyone,

I'm having an issue with Microsoft Sentinel playbooks and Logic Apps that I haven't been able to resolve.

Environment

  • Microsoft Sentinel
  • Azure Logic Apps
  • Region: South Africa North
  • Subscription: Visual Studio Enterprise Subscription
  • Sentinel enabled and operational
  • Resource providers registered
  • Creating playbooks from Sentinel Automation

Problem

When I create a playbook (Incident Trigger or Alert Trigger), the playbook opens in Logic Apps, but the Sentinel trigger shows:

Unable to initialize operation

When I click Add an action and search for:

  • Microsoft Sentinel
  • Azure Sentinel
  • Sentinel

the search spinner keeps running and no Sentinel actions are returned.

What works

Built-in actions load normally:

  • Compose
  • HTTP
  • Variables
  • Scope

These appear immediately.

What I've already checked

✅ Incognito/InPrivate browser

✅ Sign out / sign in

✅ Waited over 8 hours and retried

✅ Resource providers registered:

  • Microsoft.Web
  • Microsoft.Logic
  • Microsoft.SecurityInsights
  • Microsoft.OperationalInsights

✅ Sentinel API connection created successfully

In API Connections I can see:

  • azuresentinel-Evict-CompromisedIdentity
  • Status = Ready

✅ Playbook JSON includes:

JSON

1

"azuresentinel": {

2

"id": "/providers/Microsoft.Web/locations/southafricanorth/managedApis/azuresentinel"

3

}

Show more lines

✅ Created both:

  • Playbook with Incident Trigger
  • Playbook with Alert Trigger

Both exhibit the same issue.

Symptoms

  • Sentinel trigger appears on the canvas.
  • Trigger displays "Unable to initialize operation".
  • Sentinel actions never appear in Add Action search.
  • Built-in actions continue to work.

Question

Has anyone encountered a situation where:

  1. The Sentinel connector and API connection exist and are healthy,
  2. Built-in Logic App actions load correctly,
  3. But Microsoft Sentinel triggers/actions fail to initialize and never appear in the action catalog?

Is this a known Logic Apps designer issue, Sentinel connector issue, or regional backend issue?

Any guidance would be appreciated.

Thanks!Hi everyone,

I'm having an issue with Microsoft Sentinel playbooks and Logic Apps that I haven't been able to resolve.

Environment

  • Microsoft Sentinel
  • Azure Logic Apps
  • Region: South Africa North
  • Subscription: Visual Studio Enterprise Subscription
  • Sentinel enabled and operational
  • Resource providers registered
  • Creating playbooks from Sentinel Automation

Problem

When I create a playbook (Incident Trigger or Alert Trigger), the playbook opens in Logic Apps, but the Sentinel trigger shows:

Unable to initialize operation

When I click Add an action and search for:

  • Microsoft Sentinel
  • Azure Sentinel
  • Sentinel

the search spinner keeps running and no Sentinel actions are returned.

What works

Built-in actions load normally:

  • Compose
  • HTTP
  • Variables
  • Scope

These appear immediately.

What I've already checked

✅ Incognito/InPrivate browser

✅ Sign out / sign in

✅ Waited over 8 hours and retried

✅ Resource providers registered:

  • Microsoft.Web
  • Microsoft.Logic
  • Microsoft.SecurityInsights
  • Microsoft.OperationalInsights

✅ Sentinel API connection created successfully

In API Connections I can see:

  • azuresentinel-Evict-CompromisedIdentity
  • Status = Ready

✅ Playbook JSON includes:

JSON

1

"azuresentinel": {

2

"id": "/providers/Microsoft.Web/locations/southafricanorth/managedApis/azuresentinel"

3

}

Show more lines

✅ Created both:

  • Playbook with Incident Trigger
  • Playbook with Alert Trigger

Both exhibit the same issue.

Symptoms

  • Sentinel trigger appears on the canvas.
  • Trigger displays "Unable to initialize operation".
  • Sentinel actions never appear in Add Action search.
  • Built-in actions continue to work.

Question

Has anyone encountered a situation where:

  1. The Sentinel connector and API connection exist and are healthy,
  2. Built-in Logic App actions load correctly,
  3. But Microsoft Sentinel triggers/actions fail to initialize and never appear in the action catalog?

Is this a known Logic Apps designer issue, Sentinel connector issue, or regional backend issue?

Any guidance would be appreciated.

Thanks!

Update

Further troubleshooting has been completed.

Environment

  • Subscription: Visual Studio Enterprise Subscription
  • Original Region: South Africa North
  • Additional Test Region: North Europe

Additional Findings

  1. Deleted and recreated the Sentinel playbook.
  2. Created both:
    • Microsoft Sentinel Incident playbook
      • Microsoft Sentinel Alert playbook
      1. Both show:

      Unable to initialize operation

      1. Verified:
        • Microsoft.Web registered
          • Microsoft.Logic registered
            • Microsoft.SecurityInsights registered
              • Microsoft.OperationalInsights registered
              1. Verified Sentinel API Connection is created successfully and shows Ready status.
              2. Created a completely new Logic App in a new Resource Group in North Europe.
              3. In the new Logic App:
                • Microsoft Sentinel does not appear in trigger search.
                  • Office 365 Outlook does not appear in trigger search.
                    • Microsoft Teams does not appear in trigger search.
                    1. Built-in actions such as:
                      • Compose
                        • HTTP
                          • Variables load correctly.

Conclusion

The issue appears to affect all shared/managed connectors, not just Microsoft Sentinel.

The Logic Apps Designer appears unable to discover shared connectors, while built-in actions continue to function normally.

Has anyone seen this behavior before, or can a Microsoft engineer verify whether this is a backend issue affecting connector discovery for this tenant/subscription?

Update

Further troubleshooting has been completed.

Environment

  • Subscription: Visual Studio Enterprise Subscription
  • Original Region: South Africa North
  • Additional Test Region: North Europe

Additional Findings

  1. Deleted and recreated the Sentinel playbook.
  2. Created both:
    • Microsoft Sentinel Incident playbook
      • Microsoft Sentinel Alert playbook
      1. Both show:

      Unable to initialize operation

      1. Verified:
        • Microsoft.Web registered
          • Microsoft.Logic registered
            • Microsoft.SecurityInsights registered
              • Microsoft.OperationalInsights registered
              1. Verified Sentinel API Connection is created successfully and shows Ready status.
              2. Created a completely new Logic App in a new Resource Group in North Europe.
              3. In the new Logic App:
                • Microsoft Sentinel does not appear in trigger search.
                  • Office 365 Outlook does not appear in trigger search.
                    • Microsoft Teams does not appear in trigger search.
                    1. Built-in actions such as:
                      • Compose
                        • HTTP
                          • Variables load correctly.

Conclusion

The issue appears to affect all shared/managed connectors, not just Microsoft Sentinel.

The Logic Apps Designer appears unable to discover shared connectors, while built-in actions continue to function normally.

Has anyone seen this behavior before, or can a Microsoft engineer verify whether this is a backend issue affecting connector discovery for this tenant/subscription?

Additional update:

I created a completely new Logic App in North Europe and tested connector discovery. Microsoft Sentinel, Microsoft Teams, and Office 365 Outlook did not appear in search results.

I was later able to create a new Sentinel playbook which successfully triggered and executed.

However, after additional testing, the connector discovery problem returned and Microsoft Sentinel again disappeared from the search experience.

I also captured a failed Sentinel action returning:

Invalid subscription id or resource group or API connection

along with request ID:

235c546b-291a-40ac-bc13-377ed98fd618

Given that:

  • The issue reproduces across South Africa North and North Europe.
  • Other shared connectors (Outlook, Teams) are also affected.
  • A Sentinel workflow was able to execute at least once.

could this indicate an intermittent Logic Apps connector catalog/metadata service issue rather than a Sentinel-specific problem?

Azure Logic Apps
Azure Logic Apps

An Azure service that automates the access and use of data across clouds without writing code.

Answer accepted by question author
Likhitha Sulake 100 Reputation points Microsoft External Staff Moderator
2026-08-09T11:53:47.6366667+00:00

Hi @Joshua Adeleye ,

Based on your results, the issue does not appear to be related to Sentinel permissions or the Logic App workflow itself. Since the built-in actions load normally but Shared/managed connectors such as Sentinel, Teams, and Office 365 Outlook do not appear, the issue is more likely related to the managed connector service or the network path used to access it.

Could you please try the following checks?

  1. Run the following command to confirm whether the connectors are available through the Azure management API: az rest --method get --url "https://management.azure.com/subscriptions/<subId>/providers/Microsoft.Web/locations/northeurope/managedApis?api-version=2016-06-01"
  2. From the same machine, check whether the connector endpoint is reachable: nslookup northeurope.azure-apihub.net curl -I https://northeurope.azure-apihub.net
  3. Please also confirm that the Azure subscription status is Enabled.

If the connectors are returned by the Azure CLI but are still missing from the Logic Apps designer, this would strongly indicate that the issue is with the browser/network path rather than the Logic App configuration.

As a temporary workaround, you can continue building the workflow using the built-in HTTP action instead of the managed connector.

Please share the output of the above checks (with any sensitive information removed), and we can narrow down the issue further.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jerald Felix 18,680 Reputation points Volunteer Moderator
    2026-08-02T03:54:35.27+00:00

    Hello Joshua Adeleye,

    Greetings! Thanks for raising this question in the Q&A forum

    The behavior you're seeing (Sentinel trigger stuck on "Unable to initialize operation" plus an empty action search, while built-in actions like Compose/HTTP load fine) points to the Logic Apps designer failing to retrieve the Sentinel managed connector's Swagger/operation metadata from the backend, rather than a permissions or resource-provider problem on your side. Since built-in actions don't call out to a managed API backend, they're unaffected, but anything that depends on the azuresentinel managed connector (trigger schema, action list) fails to initialize when that metadata call doesn't return successfully. This is most commonly caused by one of the following:

    1. Region mismatch between the Logic App, the resource group, and the API connection. The Microsoft Sentinel managed connector requires the API connection resource to be created in the exact same region as the Logic App (and ideally the same resource group). Even though your connection shows "Ready," a mismatch here is a well-documented cause of designer metadata failures. In the portal, open the azuresentinel-Evict-CompromisedIdentity connection resource and confirm its Location property is identical to the Logic App's region (South Africa North), not just "same subscription."
    2. Regional backend instability for managed connectors in South Africa North. This region has a history of intermittent connector-metadata issues reported on this forum (custom connectors failing to save/update, operation details failing to initialize) that were traced back to backend service health in that specific region rather than anything configurable in the customer's tenant. Since you've already ruled out browser cache, sign-in state, and an 8-hour wait, this points toward a regional platform issue rather than something fixable from your side.
    3. Stale or corrupted connection object. Even a "Ready" connection can hold a cached/corrupted operation definition. Delete the existing azuresentinel-Evict-CompromisedIdentity connection and the Sentinel trigger/action shapes in the workflow, then re-add the Sentinel trigger from scratch (not by re-authenticating the old connection) so the designer re-pulls the Swagger definition fresh.

    Steps to try, in order:

    1. Verify region alignment
      • Go to the API connection resource azuresentinel-Evict-CompromisedIdentity → Overview → confirm Location exactly matches the Logic App's region.
        • If they differ, delete the connection and recreate it while the Logic App designer is open in the correct region, so the connection is provisioned in the same region automatically.
        1. Recreate the trigger and connection from scratch
          • Delete the Sentinel trigger shape from the canvas.
            • Delete the existing API connection resource entirely (not just disconnect).
              • Re-add Microsoft Sentinel – When an incident is created or updated (or Alert trigger) as a brand-new step and go through Add new connection → Sign in again, rather than reusing the existing connection.
              1. Test in a different region as a diagnostic step
                • Create a throwaway Logic App + Sentinel playbook in a region known to be stable (e.g., West Europe or North Europe) pointing at the same Sentinel workspace. If the trigger initializes and actions load there, this confirms a regional backend issue specific to South Africa North rather than a configuration problem.
                1. Check the network trace for a Correlation ID
                  • Open browser dev tools (F12) → Network tab, reproduce the "Unable to initialize operation" error, and find the failed call to management.azure.com for the connector's Swagger/operation metadata.
                    • Capture the x-ms-correlation-request-id (or x-ms-request-id) header value and the HTTP status code returned. You'll need this for support.
                    1. Escalate to Azure Support if the issue persists after the above
                      • Since this presents as a platform-side metadata retrieval failure rather than something addressable through configuration, and you already hold a Visual Studio Enterprise subscription (which includes a limited developer support benefit), open a support ticket under Logic Apps as the service, category Designer / connector issue.
                        • Include: subscription ID, resource group, Logic App name, region (South Africa North), the correlation/request ID captured in step 4, and a note that the same symptom occurs on both Incident and Alert triggers.
                          • Request escalation to the Logic Apps connector platform team, since Sentinel connector issues of this nature are typically routed there rather than to the Sentinel product team.

    If this answer helps you kindly accept the answer which will help others who have similar questions.

    Best Regards,
    Jerald Felix.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.