Your company deploys Azure Sentinel.

In Microsoft Sentinel (Defender XDR SIEM), access control is based on Azure RBAC (Role-Based Access Control) to ensure least privilege operations. According to Microsoft’s Sentinel role documentation:

Logic App Contributor: This role is required to create and run playbooks (automated workflows built on Azure Logic Apps). Although Sentinel integrates with Logic Apps, playbook creation and execution permissions are governed by the Logic App Contributor role at the resource group or subscription level where playbooks are deployed. Without this role, a user cannot design or execute automated responses.

Azure Sentinel Contributor: This role grants permission to create, edit, and delete analytic rules, workbooks, and hunting queries within the Sentinel workspace. It does not allow modifying playbooks or executing automation unless combined with Logic App Contributor. It’s the appropriate role for analysts or engineers who manage detection content (rules and visualizations).

The Azure Sentinel Reader role only allows viewing incidents, workbooks, and rules but not editing or creating them. The Sentinel Responder role focuses on handling and closing incidents, not authoring content or automation.

✅ Final Mapping:

Create and run playbooks → Logic App Contributor

Create workbooks and analytic rules → Azure Sentinel Contributor