Microsoft Sentinel - GSuite GCP IAM Connector - 403 Forbidden

[pratikghogre8cap]

Describe the bug
Issue 1. The function app returns a 403 forbidden error, even when instructed permissions have been given.
Issue 2. Updating python returns "Result: Failure Exception: ModuleNotFoundError: No module named '_cffi_backend'. Cannot find module." error.

To Reproduce
Steps to reproduce the behavior:

1. Go to Google Cloud Platform IAM (using Azure Functions) in Sentinel.
2. Click on Deploy to Azure
3. Enter the requested information.
4. Once deployed, go to function app and click on Overview.
5. Click on Invocations and More, under Monitor on the Overview page.

For python error:
6. Update the python to anything above 3.8 and see the logs in invocation.

Expected behavior
Ideally the product should start collecting logs. But it fails.

Screenshots

1. Forbidden Error Log:
   

2. Python Error Log:
   

3. GCP Permissions Screenshot:
   
   

Desktop (please complete the following information):

• OS: Windows 2011 Endpoint.
• Chrome OS
• Google Chrome | 127.0.6533.120 (Official Build) (64-bit) (cohort: Stable)

Additional context
The google account used to grant permissions was a superadmin, with all relevant roles assigned.
The permissions advised on the connector instructions were granted.

[v-sudkharat]

Hi @pratikghogre8cap, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-sudkharat]

Hi @pratikghogre8cap, Our team has received your created support ticket, and they are checking on the issue, and our support team will post the updates.
we are this issue from here, If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.