services / Azure / Log Analytics storage insight configuration

A storage insight configuration that pulls log data from a linked storage account (e.g. diagnostic logs, WAD/LAD tables) into the workspace.

These configs are an ingestion path from storage into the workspace; removing them stops that telemetry from being read in; HIGH.

Microsoft.​OperationalInsights/​workspaces/​storageinsightconfigs/​delete

Deleting a storage insight config stops the workspace reading logs from the storage account, cutting that ingestion source.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links