services / Azure / Defender for Cloud security operators

SecurityOperators are managed-identity bindings that enable Microsoft Defender for Cloud security plans (e.g. CSPM/agentless scanning) at a scope by associating a security operator identity with the requisite RBAC roles.

The operator is a privileged security-plane identity, so creating/deleting it affects both privilege posture and defensive coverage.

Microsoft.​Security/​securityoperators/​write

Creating/updating a security operator provisions and binds a managed identity with security-plane RBAC at the scope, granting an attacker a privileged identity to act through (lateral/privilege) and the ability to repoint or weaken Defender enforcement.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links