services / Azure / Defender for Cloud security operators

SecurityOperators are managed-identity bindings that enable Microsoft Defender for Cloud security plans (e.g. CSPM/agentless scanning) at a scope by associating a security operator identity with the requisite RBAC roles.

The operator is a privileged security-plane identity, so creating/deleting it affects both privilege posture and defensive coverage.

Microsoft.​Security/​securityoperators/​delete

Deleting the security operator removes the identity that drives a Defender for Cloud security plan, disabling that defense mechanism's coverage at the scope.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links