Sentinel Administrators and developers will need access to create analytic rules, hunter queries, workbooks, and playbooks.Your Sentinel Administrator should be approving and periodically reviewing Sentinel access (possibly assigning access).Sentinel Administrators and Responders may need temporary access to highly secured resources for deeper analysis.Developers may need Sentinel Contributor access to test and deploy new solutions.You may need to store and retrieve keys from a Key Vault and Azure AD.Activating and developing API-based connectors may require the creation and management of App Registrations in Azure AD.Setting up Notebooks may require activation of Machine Learning services.Activating and modifying connectors involving Azure services often requires Global Admin or Security Admin.These credentials can and should only be granted on a temporary basis. Sentinel administrators will need elevated access for certain activities. You may also want to designate persistent assignments, temporary elevated access, and hybrid access requirements. Consider designating the scope (SUB,RG,WS) and highlighting custom roles. The groups can be documented in a matrix for reference and tracking. Assign built-in and custom roles to these groups as needed. I recommend setting up user groups to define access for each category of Sentinel user.

In this article I describe a custom Sentinel Advanced Responder role and several interesting points around Sentinel access management. I was recently asked by a customer to help prepare a matrix covering role-based access for Sentinel users and administrators.

Matrix sentinel