Sentinel SIEM playbooks

I’ve been dabbling with Sentinel playbooks lately, specifically for incidents that are detected by defender. I’ve got all the right analytic workbooks, connectors and playbooks from the content store setup. I have the right permissions in the resource group to do this. I have the sentinel managed identity setup with the right permissions to run the playbooks. Any time I try to use a playbook that hits defender for an action such as “run full virus scan” or “block mde …

connectors cybersecurity defender identity incidents managed permissions playbooks resource run sentinel siem store workbooks