Reset-AADPassword Prerequisites is wrong.

[ankkp]

Describe the bug
I was testing Reset-AADPassword playbook and followed the permission steps. But I still get error for https-reset password step.

{
  "error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {

To Reproduce
Steps to reproduce the behavior:
follow link above

Expected behavior
playbook should run sucessfully.

Screenshots

Desktop (please complete the following information):
NA

Smartphone (please complete the following information):
NA

Additional context
I think MI needs more permission.

Example:
$MIGuid = "<Enter your managed identity guid here>" $MI = Get-AzureADServicePrincipal -ObjectId $MIGuid $GraphAppId = "00000003-0000-0000-c000-000000000000" $PermissionName = "User.ReadWrite.All" $GraphServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$GraphAppId'" $AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"} New-AzureAdServiceAppRoleAssignment -ObjectId $MI.ObjectId -PrincipalId $MI.ObjectId
-ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id`

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[ankkp]

@rahul0216

If you could look at this or get the right person to review it.

Thank you

[rahul0216]

Thanks @ankkp for reporting this. @v-rbajaj and @v-sudkharat will look into the issue.

[v-rbajaj]

Hi @ankkp, we are investigating this issue but most probably looking at the error message, it looks like there aren't sufficient privileges to run this playbook for you and hence you are getting authorization error.

[ankkp]

hello @v-rbajaj Please resolve it I missed part MI needing GA permission for admin accounts.

[ankkp]

hello @v-rbajaj Please resolve it I missed part MI needing GA permission for admin accounts.