services / Azure / Log Analytics linked storage account

A customer-owned storage account linked to the workspace for holding certain data types (custom logs, queries, alerts) under the customer's own storage.

Linked storage accounts back specific ingestion/retention paths; removing them can disrupt that data flow and its retained records; HIGH.

Microsoft.​OperationalInsights/​workspaces/​linkedstorageaccounts/​delete

Removing a linked storage account cuts the storage backing its data type, disrupting ingestion or retention of those records.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links