Back to Operations

Run playbook

Microsoft Security Insights

Operation Information

Details and metadata

Operation Name
Microsoft.SecurityInsights/incidents/runPlaybook/action
Display Name
Run playbook
Description
Run playbook on incident
Operation Type
Control Plane
Provider
Microsoft Security Insights
Resource Type
Incidents

Roles Allowing This Operation

8 roles grant this permission

Role Name Actions Data Actions Note
Contributor
b24988ac-6180-42a0-ab88-20f7382dd24c
 17,503 0 —
Defender Unified RBAC Contributor and Responder
625a1cea-653b-4a19-bd3a-df1d66ab6637
 1,100 0 —
Defender Unified RBAC Responder
1bacae94-6c0f-4d2d-8dfa-408d5a28e6ec
 1,003 0 —
Microsoft Sentinel Contributor
ab8e14d6-4a74-4a29-9ba8-549422addade
 1,122 0 —
Microsoft Sentinel Responder
3e150937-b8fe-4cfb-8069-0eaf05ecd056
 1,022 0 —
Owner
8e3af657-a8ff-443c-a75c-2fe8c4bcb635
 17,549 0 —
Service Group Administrator
4e50c84c-c78e-4e37-b47e-e60ffea0a775
 17,547 0 —
Service Group Contributor
32e6a4ec-6095-4e37-b54b-12aa350ba81f
 17,547 0 —

Note: This list includes roles where the operation is allowed by the role's actions or dataActions patterns, excluding any patterns in notActions or notDataActions. Wildcard patterns (like */read or *) are expanded to match this specific operation.