services / Azure / Defender for Cloud settings

Scope-level Microsoft Defender for Cloud settings, including integration toggles such as Microsoft Defender for Cloud Apps (MCAS) and WDATP/Defender for Endpoint data sharing.

These toggles govern which detection integrations and data feeds are active; disabling them reduces detection coverage rather than touching production data.

Microsoft.​Security/​settings/​write

Turning off integration settings (e.g. MCAS/WDATP data sharing) severs detection data feeds, degrading threat coverage and altering the effective security configuration.

Risks

1. Data manipulation (HIGH)
2. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links