services / Azure / Security policies

The Defender for Cloud security policy (the set of security assessment/compliance rules evaluated against resources) governing which misconfigurations and threats are checked for at the scope.

This is security-scanning policy, not IAM/access policy; weakening it reduces which findings are detected, affecting detection posture rather than access control.

Microsoft.​Security/​policies/​write

Editing the security policy can disable assessment rules so the attacker's misconfigurations go undetected, weakening the detection posture and manipulating what the security scan reports.

Risks

1. Data manipulation (HIGH)
2. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links