diff --git a/Playbooks/Restrict-MDEIPAddress/readme.md b/Playbooks/Restrict-MDEIPAddress/readme.md index 6adca6c772d..d976db73ced 100644 --- a/Playbooks/Restrict-MDEIPAddress/readme.md +++ b/Playbooks/Restrict-MDEIPAddress/readme.md @@ -32,7 +32,7 @@ $MI = Get-AzureADServicePrincipal -ObjectId $MIGuid $MDEAppId = "fc780465-2017-40d4-a0c5-307022471b92" $PermissionName = "Ti.ReadWrite" -$RoleName = "Microsoft Sentinel Reader" +$RoleName = "Microsoft Sentinel Responder" $MDEServicePrincipal = Get-AzureADServicePrincipal -Filter "appId eq '$MDEAppId'" $AppRole = $MDEServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains "Application"}