services / Azure / Log Analytics workspace

An Azure Log Analytics workspace is the central data store and management resource for Azure Monitor logs, collecting and retaining telemetry/log data from agents, resources, and Microsoft Sentinel.

Monitoring/diagnostics asset; it concentrates security and operational telemetry, so tampering with or destroying it enables anti-forensic evasion, but it is scoped to a monitoring function rather than to primary production data or identity controls.

Microsoft.​OperationalInsights/​workspaces/​listKeys/​action

Returns the workspace ingestion keys exactly like the sharedkeys action, exposing credential material usable to submit falsified log data into the workspace.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links