Issue

I need to remove delegation access for Red Canary from my Azure tenant for Microsoft Sentinel.

Environment

Microsoft Sentinel 

Resolution

1. Within Azure, navigate to the My Customers page 
2. Select Delegations
3. Find the delegation you want to remove, then select the trash can icon that appears in its row

See Remove access to a delegation for more options to remove this access.

Cause

When we set up the Microsoft Sentinel Integration, you will be provided an ARM template from Red Canary to deploy for providing Red Canary the appropriate access to your Azure tenant. If the Red Canary team is reporting issues with accessing your environment, we may advise you to remove/re-add your delegation access as a troubleshooting step.