Requirements

The account running the install needs, on the target resource group:

• Contributor — to create the Logic Apps, tables, workbooks, and connector.
• Owner or User Access Administrator — the deployment creates role assignments for the playbook and pipeline managed identities. Contributor alone fails partway through with AuthorizationFailed.

These resource providers must be registered on the subscription (the wizard checks and prompts if missing): Microsoft.OperationsManagement, Microsoft.OperationalInsights, Microsoft.Insights, Microsoft.Logic.

You need a Log Analytics workspace with Microsoft Sentinel enabled, in the same resource group you install the solution into. The wizard's workspace dropdown only lists workspaces in the selected resource group, and the automatic role assignments are scoped to that resource group.

If the workspace was Sentinel-enabled through the Azure portal, you're set. If it was enabled via CLI or ARM, confirm it appears in the Microsoft Sentinel workspace picker — CLI enablement can miss the legacy SecurityInsights solution resource the picker requires.

Your Whisper API key lives in Azure Key Vault; playbooks and pipelines read it at runtime with their managed identities. The vault must:

• Be in the same resource group as the workspace and the solution deploy.
• Use the Azure RBAC permission model, not vault access policies. The install grants Key Vault Secrets User via RBAC; on an access-policy vault that grant has no effect and every Logic App run fails with 403 when fetching the secret.

You — the installer — need rights to create a secret in the vault, for example Key Vault Secrets Officer.

Sign up at whisper.security/pricing. Any plan works for the install itself; the plan tier governs API entitlements and rate limits:

Next: Installation.