services / Azure / Log Analytics workspace

A Log Analytics workspace, the central log store that ingests and retains telemetry for Azure Monitor and Microsoft Sentinel; it holds the security-relevant logs that every downstream detection and investigation depends on.

The workspace aggregates security and operational logs across many organizational functions and is the evidence store for incident response, so the resource type is HIGH.

Microsoft.​OperationalInsights/​workspaces/​delete

Deletes the entire log store, destroying all retained telemetry and the audit trail in one action.

Risks

1. Data destruction (CRITICAL)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links