services / Azure / Log Analytics workspace query (Analytics)

The api/query action runs KQL search queries against the data ingested into a Log Analytics workspace, returning the actual log and telemetry records.

Workspace logs frequently contain security events, audit trails, and sensitive operational data; querying is the primary data-access path.

Microsoft.​OperationalInsights/​workspaces/​Api/​Query/​action

This API-path KQL search returns ingested log/telemetry records, enabling export of potentially sensitive security, audit, and operational data.

Risks

1. Data exfiltration (CRITICAL)
2. Logs exfiltration (MEDIUM)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links