What Changed

A new Bash helper script (sentinel-training-lab-onboarding.sh) has been added to the Microsoft Sentinel Training Lab under Tools/Microsoft-Sentinel-Training-Lab/Tools/. The README has been updated to document this automated path alongside the existing manual PowerShell instructions.

Operational Detail

The script addresses a known Azure race condition: when a user-assigned managed identity (UAMI) is created, the corresponding service principal may not be immediately resolvable in Microsoft Graph. Calling POST /appRoleAssignedTo before the principal is visible returns Request_BadRequest: Not a valid reference update, leaving the Training Lab deployment without the required CustomDetection.ReadWrite.All permission and causing subsequent ARM template deployments to fail.

The script mitigates this by:

  1. Creating or reusing the SentinelDetectionRulesIdentity UAMI (idempotent).
  2. Polling GET /v1.0/servicePrincipals/{principalId} up to 60 times (5-second intervals, 5-minute maximum) before attempting the app role assignment.
  3. Checking for an existing CustomDetection.ReadWrite.All assignment and skipping the POST if already present.
  4. Verifying the assignment via a follow-up Graph query before exiting.
  5. Printing the detectionRulesIdentityResourceId value and the official Deploy to Azure URL.

The script runs in Azure Cloud Shell (Bash) and requires an account with appropriate Azure resource permissions and a supported Microsoft Entra administrator role. No ARM templates, Analytic Rules, or KQL content are modified.

Affected Files

Tools/Microsoft-Sentinel-Training-Lab/README.md
Tools/Microsoft-Sentinel-Training-Lab/Tools/sentinel-training-lab-onboarding.sh