Handle entity playbooks that have no incident to update

Source facts

An entity-trigger Sentinel playbook can use Incident ARM ID to update the incident associated with its entity. When it starts outside an incident, such as during threat hunting, that field is null and an incident-dependent workflow can fail before completion. Microsoft recommends checking the field before dependent actions and providing a different action path when it is null. Microsoft Learn.

Applicability

Use this check for entity playbooks that can be invoked in more than one investigative context. The absence of an incident identifier should be treated as a supported input circumstance to handle, not automatically as a missing analyst permission or an invitation to invent an identifier.

DSE recommendation

Branch on the presence of Incident ARM ID before the first action that needs it, and define the incident-free outcome deliberately. Ask the workflow owner which entity-only work is useful and where its result should be presented. Keep any incident creation or association decision explicit and separately authorized. Do not silently attach hunting results to an unrelated case to satisfy an action’s input requirement.

Verification

Rehearse the same approved benign entity operation once from an incident and once from an incident-free hunting context. Inspect the identifier actually received and the branch taken in each run. Confirm that the incident path updates the intended case and that the other path ends with the agreed result instead of a failed update step. Preserve both run outcomes so later edits cannot be accepted on incident-only testing.

Official references

Microsoft Learn: Creating Sentinel playbooks and handling entity inputs. Source reviewed September 9, 2026.