services / Azure / Log Analytics workspace

An Azure Log Analytics workspace is the central data store and management resource for Azure Monitor logs, collecting and retaining telemetry/log data from agents, resources, and Microsoft Sentinel.

Monitoring/diagnostics asset; it concentrates security and operational telemetry, so tampering with or destroying it enables anti-forensic evasion, but it is scoped to a monitoring function rather than to primary production data or identity controls.

Microsoft.​OperationalInsights/​workspaces/​sharedKeys/​action

Retrieves the workspace primary/secondary shared keys (credential material), letting an attacker connect agents and inject or forge log telemetry to poison or mask events.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links