# Handle entity playbooks that have no incident to update

> How should a Sentinel entity playbook behave when hunting starts it without an Incident ARM ID?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-270-handle-entity-playbooks-that-have-no-incident-to-update/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:26+00:00
- Modified: 2026-09-10T01:23:48+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

How should a Sentinel entity playbook behave when hunting starts it without an Incident ARM ID?

## Potentially affected

Microsoft Sentinel entity-trigger playbooks that use an associated Incident ARM ID in subsequent actions.

## DSE recommendation

Branch on the presence of Incident ARM ID before the first action that needs it, and define the incident-free outcome deliberately.

## Article

## Source facts

An entity-trigger Sentinel playbook can use Incident ARM ID to update the incident associated with its entity. When it starts outside an incident, such as during threat hunting, that field is null and an incident-dependent workflow can fail before completion. Microsoft recommends checking the field before dependent actions and providing a different action path when it is null. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/sentinel/automation/create-playbooks).

## Applicability

Use this check for entity playbooks that can be invoked in more than one investigative context. The absence of an incident identifier should be treated as a supported input circumstance to handle, not automatically as a missing analyst permission or an invitation to invent an identifier.

## DSE recommendation

Branch on the presence of Incident ARM ID before the first action that needs it, and define the incident-free outcome deliberately. Ask the workflow owner which entity-only work is useful and where its result should be presented. Keep any incident creation or association decision explicit and separately authorized. Do not silently attach hunting results to an unrelated case to satisfy an action’s input requirement.

## Verification

Rehearse the same approved benign entity operation once from an incident and once from an incident-free hunting context. Inspect the identifier actually received and the branch taken in each run. Confirm that the incident path updates the intended case and that the other path ends with the agreed result instead of a failed update step. Preserve both run outcomes so later edits cannot be accepted on incident-only testing.

## Official references

[Microsoft Learn: Creating Sentinel playbooks and handling entity inputs](https://learn.microsoft.com/en-us/azure/sentinel/automation/create-playbooks). Source reviewed September 9, 2026.

## Primary reference

- Name: Create and manage Microsoft Sentinel playbooks | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/sentinel/automation/create-playbooks
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Handle entity playbooks that have no incident to update,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-270-handle-entity-playbooks-that-have-no-incident-to-update/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.