Microsoft Sentinel–Automations do not run

A very common mistake when I see Sentinel implementations on clients is not running the automations.

To understand the problem, it is interesting to interconnect with Power Platform applications such as Power Apps, where the user needs to authorize the Office 365 account for the app to run. This is done on first run and Power Apps or Power Automate will save the connection user.

The same happens with Sentinel automations, they are not necessarily linked to an Automation Account and with that it is necessary to authenticate all connections !

How do I know if I have unauthenticated automations?

Open Sentinel and click Automations.

When opening click on the option that will appear at the top of the list on the right side “API Connections”.

Filter for automations that have errors.

For automations that have an error in connection, open their properties and go to the “Edit API Connection” option and voilá found the problem 

Remembering that the API connections can be different, Office 365 if sending an email, key for applications, SAS for storage and other specific data that has been used in automation and needs to have the credential.

Now you can see that the same automations with error will appear as “Connected” indicating that they are now working.