Revert: ship automation rules as manual Deploy-to-Azure, not a packaged playbook

Automation rules are Microsoft.SecurityInsights/automationRules, not Logic
App playbooks (Microsoft.Logic/workflows). Packaging them as a Playbook
content type produced a broken 'Playbook template' in Content Hub that fails
to load (the portal tries to parse a Logic App trigger/connectors and can't).

Confirmed no solution in the repo packages automation rules (0 hits across
all Package/mainTemplate.json). The established pattern - e.g. Check Point
Cyberint Alerts - ships the automation-rules ARM template under Playbooks/
but keeps it OUT of the data file, delivering it via a one-click
Deploy to Azure button instead.

Changes:
- Remove the Playbooks entry from the solution data file so the automation
  rules are no longer packaged as a (broken) playbook content template.
- Remove the now-unused PlaybookName parameter from azuredeploy.json.
- Keep the automation-rules ARM template + Deploy-to-Azure button under
  Playbooks/MicrosoftADTierModelAutomationRules/ (Check Point pattern).
- Repackage: mainTemplate.json now cleanly ships 19 analytic rules + 1
  workbook (0 automationRules). Version held at 3.0.0.

Verified in lab: Content Hub shows 19 analytic templates + 1 workbook, an
empty Playbook templates tab (no failed-to-load error), and the 5 automation
rules deploy correctly via the button. Full validation: ARM-TTK 48 passed,
15 passed / 0 failed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 722d3473-56e9-4c4a-be7a-b8eccec306dc

Author: 2 people

Solutions/Microsoft Active Directory Tier Model/Data/Solution_MicrosoftActiveDirectoryTierModel.json

@@ -28,9 +28,6 @@
     "Analytic Rules/TM018_DOMAINChildDomainPromotedWithinTheForest.yaml",
     "Analytic Rules/TM019_TRUSTANewADTrustHasBeenEstablished.yaml"
   ],
-  "Playbooks": [
-    "Playbooks/MicrosoftADTierModelAutomationRules/azuredeploy.json"
-  ],
   "BasePath": "Solutions/Microsoft Active Directory Tier Model",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,

Solutions/Microsoft Active Directory Tier Model/Package/3.0.0.zip

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/MicrosoftADTierModel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Active Directory Tier Model solution for Microsoft Sentinel provides detection, triage automation, and reporting for the Active Directory (AD) administrative tier model - Tier 0 (T0), Tier 1 (T1), and Tier 2 (T2) - across Active Directory Domain Services (AD DS / ADDS). It monitors tier-sensitive changes on Domain Controllers, including group membership, object creation and deletion, ACL modifications, Group Policy (GPO) links and enforcement, organizational unit (OU) changes, block inheritance, domain trusts, child-domain promotion, BitLocker recovery keys, and LAPS activity, using Windows Security Event logs.\n\nThe analytic rules dynamically build each alert title from the affected object's tier and type, which keeps the number of rules low instead of duplicating a rule per tier. Automation rules then tag Tier Model incidents and automatically set severity or close expected, low-value activity, and a workbook provides Tier Model metrics.\n\n**Important:** The analytic rules, automation rules, and workbook are linked by the rule names - each alert title carries a (TMxxx.1) identifier that the automation rules and workbook depend on. Do not rename or modify the default analytic and automation rule names, or the automation rules and workbook will not function correctly.\n\n**Prerequisites:**\n\n1. Active Directory Tier Model deployed. This solution monitors an existing Tier Model and expects the standard Tier 0 / Tier 1 / Tier 2 organizational unit (OU) structure (for example, OU=Tier 0 Accounts, OU=Tier 1 Member Servers, OU=Tier 0 PAW, OU=Tier 0 Groups). If your OU names differ, adjust the analytic rule queries to match. To deploy and audit the Tier Model, see the [Microsoft Active Directory Tier Model project](https://github.com/microsoft/ActiveDirectoryTierModel/) and its [documentation](https://microsoft.github.io/ActiveDirectoryTierModel/).\n\n2. Domain Controller telemetry. All Domain Controllers must run as Azure virtual machines or be onboarded to Azure Arc, with a Data Collection Rule (DCR) that collects Security event logs from every Domain Controller into the Microsoft Sentinel workspace.\n\n3. Automation rules (required). The solution's automation rules are provided as an ARM template in the solution's Playbooks folder (MicrosoftADTierModelAutomationRules) and must be deployed as a required post-installation step for incident tagging, severity assignment, and the workbook to function correctly. See the automation rules README for one-click deployment.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n1. [Azure Monitor Agent (AMA) and Data Collection Rules](https://learn.microsoft.com/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent)\n\n2. [Windows Security Events via AMA](https://learn.microsoft.com/azure/sentinel/data-connectors/windows-security-events-via-ama)\n\n**Workbooks:** 1, **Analytic Rules:** 19, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/MicrosoftADTierModel.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Active%20Directory%20Tier%20Model/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Active Directory Tier Model solution for Microsoft Sentinel provides detection, triage automation, and reporting for the Active Directory (AD) administrative tier model - Tier 0 (T0), Tier 1 (T1), and Tier 2 (T2) - across Active Directory Domain Services (AD DS / ADDS). It monitors tier-sensitive changes on Domain Controllers, including group membership, object creation and deletion, ACL modifications, Group Policy (GPO) links and enforcement, organizational unit (OU) changes, block inheritance, domain trusts, child-domain promotion, BitLocker recovery keys, and LAPS activity, using Windows Security Event logs.\n\nThe analytic rules dynamically build each alert title from the affected object's tier and type, which keeps the number of rules low instead of duplicating a rule per tier. Automation rules then tag Tier Model incidents and automatically set severity or close expected, low-value activity, and a workbook provides Tier Model metrics.\n\n**Important:** The analytic rules, automation rules, and workbook are linked by the rule names - each alert title carries a (TMxxx.1) identifier that the automation rules and workbook depend on. Do not rename or modify the default analytic and automation rule names, or the automation rules and workbook will not function correctly.\n\n**Prerequisites:**\n\n1. Active Directory Tier Model deployed. This solution monitors an existing Tier Model and expects the standard Tier 0 / Tier 1 / Tier 2 organizational unit (OU) structure (for example, OU=Tier 0 Accounts, OU=Tier 1 Member Servers, OU=Tier 0 PAW, OU=Tier 0 Groups). If your OU names differ, adjust the analytic rule queries to match. To deploy and audit the Tier Model, see the [Microsoft Active Directory Tier Model project](https://github.com/microsoft/ActiveDirectoryTierModel/) and its [documentation](https://microsoft.github.io/ActiveDirectoryTierModel/).\n\n2. Domain Controller telemetry. All Domain Controllers must run as Azure virtual machines or be onboarded to Azure Arc, with a Data Collection Rule (DCR) that collects Security event logs from every Domain Controller into the Microsoft Sentinel workspace.\n\n3. Automation rules (required). The solution's automation rules are provided as an ARM template in the solution's Playbooks folder (MicrosoftADTierModelAutomationRules) and must be deployed as a required post-installation step for incident tagging, severity assignment, and the workbook to function correctly. See the automation rules README for one-click deployment.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n1. [Azure Monitor Agent (AMA) and Data Collection Rules](https://learn.microsoft.com/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent)\n\n2. [Windows Security Events via AMA](https://learn.microsoft.com/azure/sentinel/data-connectors/windows-security-events-via-ama)\n\n**Workbooks:** 1, **Analytic Rules:** 19\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -386,34 +386,6 @@
             ]
           }
         ]
-      },
-      {
-        "name": "playbooks",
-        "label": "Playbooks",
-        "subLabel": {
-          "preValidation": "Configure the playbooks",
-          "postValidation": "Done"
-        },
-        "bladeTitle": "Playbooks",
-        "elements": [
-          {
-            "name": "playbooks-text",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "text": "This solution installs the Playbook templates to help implement your Security Orchestration, Automation and Response (SOAR) operations. After installing the solution, these will be deployed under Playbook Templates in the Automation blade in Microsoft Sentinel. They can be configured and managed from the Manage solution view in Content Hub."
-            }
-          },
-          {
-            "name": "playbooks-link",
-            "type": "Microsoft.Common.TextBlock",
-            "options": {
-              "link": {
-                "label": "Learn more",
-                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
-              }
-            }
-          }
-        ]
       }
     ],
     "outputs": {