Secretless SOC automation
Automation that authenticates as itself, enriches freely, and never takes a consequential action without an analyst in the loop.
The problem
Security automation that hoards credentials is a liability that runs on a timer. A playbook with a stored client secret is a secret that leaks with the playbook.
The approach
Every playbook and runbook authenticates with its own system-assigned managed identity — no client secrets, no API keys stored anywhere. Where a secret is genuinely needed it's a Key Vault reference resolved at runtime, never a value in the definition.
The triggers are deliberate too. The native "Microsoft Sentinel" connector
trigger needs an interactive OAuth consent that can't be completed from CLI or
API, so the playbooks are built on plain Request and Recurrence triggers with
HTTP actions authenticated by ManagedServiceIdentity, calling ARM and
Microsoft Graph directly.
What got built
Three Logic App playbooks and two Azure Automation runbooks. Enrichment playbooks gather the evidence an analyst would gather — IP reputation, prior activity, related sign-ins — and write it to the incident as a comment. Containment actions (isolate a VM, disable a user) are manual-only by design: a consequential action should always be a deliberate analyst decision, kept outside any automatic trigger path.
One platform trap surfaced along the way: on a workspace onboarded to the
unified Defender portal, PATCH against the legacy
Microsoft.SecurityInsights/incidents ARM endpoint returns 502 regardless
of caller, payload or api-version — while GET and DELETE on the same
endpoint work. Writes have to go through the Microsoft Graph Security API
instead. Confusing to diagnose, because it looks intermittent rather than
structural.
What it taught
Enrichment is the highest-value, lowest-risk automation — it saves real analyst time and cannot make a wrong call. Automated closure is where the risk lives: if a playbook closes an incident, the classification is an assertion nobody verified, and once it's closed nobody ever will. Never auto-close what you didn't check, and never auto-close an incident that has an owner.