Hello everyone,
One of our customers is encountering the following error message when accessing SecOps SIEM.
We are using BYOID and following the setup guide from Chris Martin, see: https://medium.com/@thatsiemguy/linking-azure-idp-to-chronicle-secops-platform-ba649660d5fb
For this particular customer, there is an added complication: they do not have an Azure Entra ID P1 license and therefore are not allowed to assign a group to the Enterprise Application. They can only authorize individual users for the Enterprise App.
In GCP IAM, I mapped the Chronicle Viewer role to the following principal:
principalSet://iam.googleapis.com/locations/global/workforcePools/<WORKFORCE_POOL_ID>/attribute.userPrincipalName/<userPrincipalName>
Unfortunately, this does not seem to be working. Does anyone have any ideas?
Thank you!
