What Changed
A new Bash helper script (sentinel-training-lab-onboarding.sh) has been added to the Microsoft Sentinel Training Lab under Tools/Microsoft-Sentinel-Training-Lab/Tools/. The README has been updated to document this automated path alongside the existing manual PowerShell instructions.
Operational Detail
The script addresses a known Azure race condition: when a user-assigned managed identity (UAMI) is created, the corresponding service principal may not be immediately resolvable in Microsoft Graph. Calling POST /appRoleAssignedTo before the principal is visible returns Request_BadRequest: Not a valid reference update, leaving the Training Lab deployment without the required CustomDetection.ReadWrite.All permission and causing subsequent ARM template deployments to fail.
The script mitigates this by:
- Creating or reusing the SentinelDetectionRulesIdentity UAMI (idempotent).
- Polling GET /v1.0/servicePrincipals/{principalId} up to 60 times (5-second intervals, 5-minute maximum) before attempting the app role assignment.
- Checking for an existing CustomDetection.ReadWrite.All assignment and skipping the POST if already present.
- Verifying the assignment via a follow-up Graph query before exiting.
- Printing the detectionRulesIdentityResourceId value and the official Deploy to Azure URL.
The script runs in Azure Cloud Shell (Bash) and requires an account with appropriate Azure resource permissions and a supported Microsoft Entra administrator role. No ARM templates, Analytic Rules, or KQL content are modified.
Affected Files
Tools/Microsoft-Sentinel-Training-Lab/README.md
Tools/Microsoft-Sentinel-Training-Lab/Tools/sentinel-training-lab-onboarding.sh