services / Azure / Log Analytics workspace query (Analytics)

The analytics/query action runs KQL search queries against the data ingested into a Log Analytics workspace, returning the actual log and telemetry records.

Workspace logs frequently contain security events, audit trails, and sensitive operational data; querying is the primary data-access path.

Microsoft.​OperationalInsights/​workspaces/​analytics/​Query/​action

Executing a KQL search returns ingested log/telemetry records, enabling broad export of logs that commonly include security, audit, and sensitive organizational data.

Risks

1. Data exfiltration (CRITICAL)
2. Logs exfiltration (MEDIUM)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links