Define an access restriction policy for Standard-plan playbooks

This article describes how to define an access restriction policy for Microsoft Sentinel Standard-plan playbooks, so that they can support private endpoints.

Define an access restriction policy to ensure that only Microsoft Sentinel has access to the Standard logic app containing your playbook workflows.

For more information, see:

• Secure traffic between Standard logic apps and Azure virtual networks using private endpoints
• Supported logic app types

Define an access restriction policy

1. In the Azure portal, select the Configuration > Automation page.

2. On the Automation page, select the Active playbooks tab.

3. Filter the list for Standard-plan apps. Select the Plan filter and clear the Consumption checkbox, and then select OK. For example:

   

4. Select a playbook to which you want to restrict access. For example:

   

5. Select the logic app link on the playbook screen. For example:

   

6. From the navigation menu of your logic app, under Settings, select Networking. For example:

   

7. In the Inbound traffic area, select Access restriction.

8. Leave the Enabled from select virtual networks and IP addresses selected.

9. Under Site access and rules, select + Add. The Add rule panel opens on the side.

10. In the Add rule pane, enter the following details.

    The name and optional description should reflect that this rule allows only Microsoft Sentinel to access the logic app. Leave the fields not mentioned below as they are.

    Field	Enter or select
    Name	Enter SentinelAccess or another name of your choosing.
    Action	Allow
    Priority	Enter 1
    Description	Optional. Add a description of your choosing.
    Type	Select Service Tag.
    Service Tag (will appear only after you select Service Tag above.)	Search for and select AzureSentinel.

11. Select Add rule.

Sample policy

After following the procedure in this article, your policy should look as follows:

Related content

For more information, see:

• Automate threat response with Microsoft Sentinel playbooks
• Use playbooks with automation rules in Microsoft Sentinel
• Set up Azure App Service access restrictions