‎Unable to create automation rules for Sentinel

Hi,

Based on the 403 response, this looks like a Microsoft Defender XDR Unified RBAC permission issue, rather than only an Azure RBAC permission on the Sentinel workspace.

The error specifically shows the missing permissions:

microsoft.xdr/configuration/security/detectiontuning/manage microsoft.xdr/secops/securitydata/automation/rules/manage

I would check Microsoft Defender portal → System → Permissions → Microsoft Defender XDR → Roles and verify that the user has a Unified RBAC role containing the required manage permissions and that the role assignment is scoped to the relevant Microsoft Sentinel workspace.

Also verify under System → Permissions → Microsoft Defender XDR → Workload settings that Microsoft Sentinel is activated for Unified RBAC.

Once Sentinel is activated for Unified RBAC, permissions for the Defender portal experience are managed through Unified RBAC, so having the appropriate Azure RBAC role on the Log Analytics workspace alone might not be sufficient.

Microsoft documentation: ⁠Activate Microsoft Defender XDR Unified RBAC ⁠Configure Microsoft Sentinel scoping and permissions

I would start by checking the Unified RBAC role assigned to securityadmin1 and its scope.

Hi Jasvanth, thanks for the reply.

Now Sentinel is already directing users to Defender to make automation configuration changes. Also, in Defender I see all existing permissions are selected. See below image.

Hi Charles,

The 403 AUTOMATION_INSUFFICIENT_PERMISSIONS error indicates that the user is missing permissions in Microsoft Defender Unified RBAC, even if the required Azure RBAC roles are already assigned to the Sentinel workspace. Defender Unified RBAC centrally controls permissions for supported Defender and Sentinel experiences. [learn.microsoft.com], [learn.microsoft.com]

Please ask a Global Administrator or Security Administrator to:

1. Go to Microsoft Defender portal > System > Permissions > Roles.
2. Create or edit a Defender Unified RBAC role for the user.
3. Grant the Manage permissions corresponding to:
   • Detection tuning/configuration
     • Security data automation rules
4. Assign the role to securityadmin1, ensuring that the assignment includes the required Sentinel workspace or applicable data source scope.
5. Allow time for permission propagation, then sign out, sign back in, and retry creating the automation rule.

The permissions reported in the error are:

microsoft.xdr/configuration/security/detectiontuning/manage

microsoft.xdr/secops/securitydata/automation/rules/manage

Also verify that the user has an appropriate Microsoft Sentinel Azure role, such as Microsoft Sentinel Contributor, at the workspace or resource-group scope. Sentinel continues to use Azure RBAC for SIEM workspace resources, while Defender portal functionality can additionally depend on Defender Unified RBAC. [learn.microsoft.com], [learn.microsoft.com]

As a diagnostic step, try creating the same rule from Azure portal > Microsoft Sentinel > Automation. If it works there but fails in the Defender portal, that strongly indicates a missing Defender Unified RBAC permission rather than a workspace-role problem. Microsoft supports automation rules in both portals. [learn.microsoft.com]

If all permissions are present and the 403 continues, capture the request ID, timestamp, tenant ID, workspace resource ID, and browser network response, then open a Microsoft support case because the role assignment may not be propagating correctly