services / Azure / Defender plan security operators

Security operator resources tied to Microsoft Defender for Cloud pricing plans, each backed by a system-assigned managed identity that operates a Defender plan at the scope.

Couples Defender plan enforcement with a privileged managed identity (e.g. Security Admin-equivalent), making writes a privilege/identity concern, not just a posture toggle.

Microsoft.​Security/​pricings/​securityoperators/​write

Creating/updating a security operator provisions and assigns a system-assigned managed identity granted Defender-plan operator (Security Admin-equivalent) privileges, enabling lateral movement via that identity, persistent identity access, and privilege escalation; it can also reconfigure the plan to weaken defenses.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)
4. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links