services / Azure / Log Analytics workspace shared keys

An Azure Log Analytics workspace is the central data store and management resource for Azure Monitor logs, collecting and retaining telemetry/log data from agents, resources, and Microsoft Sentinel.

Monitoring/diagnostics asset; it concentrates security and operational telemetry, so tampering with or destroying it enables anti-forensic evasion, but it is scoped to a monitoring function rather than to primary production data or identity controls.

Microsoft.​OperationalInsights/​workspaces/​sharedKeys/​read

Despite the /read verb, this returns the actual workspace shared keys (agent-connection credentials) rather than metadata, so it is cryptographic exfiltration that also enables forged data injection.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links