services / Azure / Log Analytics workspace query (all tables)

The data-plane capability to run arbitrary KQL queries over ALL data ingested into an Azure Log Analytics workspace, spanning every table the workspace collects.

Broadest query capability over the workspace; can return any ingested telemetry, including security alerts, audit/sign-in logs, and any sensitive data captured in logs.

Microsoft.​OperationalInsights/​workspaces/​Query/​read

Grants arbitrary queries across every table, enabling wholesale export of all collected logs (exfiltration:logs), full enumeration of what is being logged (discovery:logs), and extraction of sensitive data (credentials, PII, configuration) captured within those logs (exfiltration:data).

Risks

1. Data exfiltration (CRITICAL)
2. Logs exfiltration (MEDIUM)
3. Logs discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links