Requirements
Azure permissions, the Sentinel workspace, the RBAC-mode Key Vault and the Whisper API key, with the solution version verified against.
On this page (4)
Requirements Documentation
| This page describes | Whisper Security solution for Microsoft Sentinel 3.0.0 |
| Published | First published 2026-06-01; last published 2026-07-14 |
| Verified on | Microsoft Sentinel is a managed service and pins no product version. What is pinned is the deployment template: nested Microsoft.Resources/deployments at ARM API version 2025-04-01 |
| Declared support | Any Log Analytics workspace with Microsoft Sentinel enabled. The solution declares no platform version, because Sentinel ships none |
| Clouds | Azure commercial cloud |
| Conformance | Validated against ARM-TTK and the Microsoft Sentinel solution validation set: content, detection-template schema, KQL, JSON and YAML syntax, logo, playbook, solution, workbook metadata and workbook template |
| Last checked | 2026-08-09 |
Have all of these ready before you start the install wizard — the deployment creates role assignments and reads your API key from Key Vault at runtime, so the prerequisites are stricter than a typical Content Hub solution.
Azure subscription and permissions
The account running the install needs, on the target resource group:
- Contributor — to create the Logic Apps, tables, workbooks, and connector.
- Owner or User Access Administrator — the deployment creates role assignments for the playbook and pipeline managed identities. Contributor alone fails partway through with
AuthorizationFailed.
These resource providers must be registered on the subscription (the wizard checks and prompts if missing): Microsoft.OperationsManagement, Microsoft.OperationalInsights, Microsoft.Insights, Microsoft.Logic.
A Microsoft Sentinel workspace — in the target resource group
You need a Log Analytics workspace with Microsoft Sentinel enabled, in the same resource group you install the solution into. The wizard's workspace dropdown only lists workspaces in the selected resource group, and the automatic role assignments are scoped to that resource group.
If the workspace was Sentinel-enabled through the Azure portal, you're set. If it was enabled via CLI or ARM, confirm it appears in the Microsoft Sentinel workspace picker — CLI enablement can miss the legacy SecurityInsights solution resource the picker requires.
An Azure Key Vault in RBAC mode — in the same resource group
Your Whisper API key lives in Azure Key Vault; playbooks and pipelines read it at runtime with their managed identities. The vault must:
- Be in the same resource group as the workspace and the solution deploy.
- Use the Azure RBAC permission model, not vault access policies. The install grants Key Vault Secrets User via RBAC; on an access-policy vault that grant has no effect and every Logic App run fails with 403 when fetching the secret.
You — the installer — need rights to create a secret in the vault, for example Key Vault Secrets Officer.
A Whisper API key
The solution requires one. Every playbook and every ingestion pipeline reads it from Key Vault at runtime and sends it on each query, so the install is not finished until a real key is in the vault.
Sign in and generate a key at console.whisper.security/sign-up, then store it as the secret the wizard asks for.
Next: Installation.