services / Azure / Application Insights query (logs)

The Query data-plane endpoint runs arbitrary analytics queries against the full Application Insights log/telemetry store.

Arbitrary queries can extract any stored telemetry, which may include PII, request payloads, identifiers, and tokens. isDataAction read.

Microsoft.​Insights/​Components/​Query/​Read

Runs arbitrary queries over the entire log store, enabling broad export of telemetry that may contain sensitive application and user data.

Risks

1. Data exfiltration (CRITICAL)
2. Logs exfiltration (MEDIUM)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links