Microsoft Sentinel – “Failed to fetch playbook runs in one or more selected subscriptions” and Playbook List not showing in Run playbook on incident sentinel area

The symptoms match a playbook visibility or permissions problem more than a Sentinel-to-Defender migration issue.

Use this check path:

1. In Microsoft Sentinel, go to Automation > Active playbooks.
   • Confirm the playbook appears there.
   • Confirm Status = Enabled.
   • Confirm Trigger kind = Microsoft Sentinel Incident.
   • Open the playbook from there to its Azure Logic Apps page and review run history and run results.
2. Check the selected subscriptions.
   • The Active playbooks view is filtered by the current subscription view.
   • In the Azure portal, review Directory + subscription in the global header.
   • A playbook is usable by default only in the subscription where it belongs, unless Microsoft Sentinel was specifically granted permissions to the playbook resource group.
   • The error “Failed to fetch playbook runs in one or more selected subscriptions” is consistent with a subscription-scope problem.
3. Verify Microsoft Sentinel permissions on the playbook resource group.
   • Microsoft Sentinel needs the Microsoft Sentinel Automation Contributor role on the resource group where the playbook resides.
   • To manually run playbooks, the operator also needs the Logic App Contributor role on the resource group that contains the playbooks.
   • If these permissions are missing, Microsoft Sentinel can fail to trigger the playbook and the health guidance explicitly lists “Microsoft Sentinel is missing permissions to run it” as a cause.
4. If the playbook was moved or the resource path changed, reselect it.
   • For the error “Either the playbook was not found, or Microsoft Sentinel was missing permissions on it”, the recommended action is to edit the automation rule, find and select the playbook in its new location, and save.
   • Even for manual execution, this indicates Sentinel can lose track of the playbook location or access.
5. Check for Logic Apps access restrictions.
   • If the playbook has access control restrictions, Microsoft Sentinel can be blocked from triggering it.
   • The documented error is “Access control configuration restricts Microsoft Sentinel.”
   • Remove the restriction if it blocks Sentinel from triggering the playbook.
6. Check whether the subscription is healthy and enabled.
   • If the playbook subscription is disabled or read-only, playbooks in that subscription cannot run until the subscription is re-enabled.
7. If the issue started suddenly across multiple playbooks and the portal is also showing Unexpected error, treat it as a possible service-side incident.
   • A similar Sentinel watchlist visibility issue was resolved by engineering on the backend, after which dependent playbooks started working again without customer-side changes.
   • If all permissions, trigger type, enabled state, and subscription scope are correct, and the problem appeared at the same time as portal errors, this points to a transient backend or portal issue rather than migration behavior.

What is supported by the documented behavior:

• Only enabled playbooks with the correct Microsoft Sentinel trigger are eligible.
• Playbook visibility is subscription-scoped.
• Cross-subscription use requires Sentinel permissions on the playbook resource group.
• Missing Sentinel permissions can prevent triggering.
• Access restrictions on the Logic App can block Sentinel.

References:

• Create and manage Microsoft Sentinel playbooks
• Automate threat response with playbooks in Microsoft Sentinel
• Monitor the health of your automation rules and playbooks
• Issue with Sentinel Watchlist visibility - Microsoft Q&A