services / Azure / Defender for Cloud workspace reconnection

The action that changes the reconnection settings binding Microsoft Defender for Cloud to its Log Analytics workspace for the scope.

Governs the live binding between Defender and its telemetry destination; changing it can disrupt where security data lands for the whole subscription.

Microsoft.​Security/​workspaceSettings/​connect/​action

Altering the workspace reconnection settings can rebind or break Defender's connection to its Log Analytics workspace, diverting or halting security telemetry and blinding detection.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links