services / Azure / Log Analytics linked storage account

A customer-owned storage account linked to the workspace for holding certain data types (custom logs, queries, alerts) under the customer's own storage.

Linked storage accounts back specific ingestion/retention paths; removing them can disrupt that data flow and its retained records; HIGH.

Microsoft.​OperationalInsights/​workspaces/​linkedstorageaccounts/​write

Re-pointing a linked storage account can redirect or disrupt the data written to it, breaking that ingestion/retention path.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links