services / Azure / Defender for Cloud unregistration

The action that unregisters the subscription from the Microsoft.Security resource provider (Azure Security Center / Defender for Cloud), offboarding it from Defender for Cloud.

Unregistration tears down Defender for Cloud coverage for the entire subscription, a broad single-action kill switch for cloud threat detection.

Microsoft.​Security/​unregister/​action

Unregistering the subscription offboards it from Defender for Cloud, disabling security assessments, alerts, and plans subscription-wide in a single action.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links