services / Azure / Log Analytics dedicated cluster

A dedicated Log Analytics cluster that provides customer-managed-key (CMK) backed storage for one or more linked workspaces.

A dedicated cluster stores the logs of its linked workspaces and holds their CMK association, so destroying it or changing its key affects the whole log store; HIGH.

Microsoft.​OperationalInsights/​clusters/​delete

Deleting a dedicated cluster destroys the CMK-backed storage holding its linked workspaces' logs, eliminating that data.

Risks

1. Data destruction (CRITICAL)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links