services / Azure / Defender for Cloud workspace settings

The workspace settings that determine which Log Analytics workspace Microsoft Defender for Cloud exports its security data, alerts, and agent telemetry to for the scope.

Defines the telemetry/alert destination for the whole subscription; redirecting or removing it can sever the flow of security data to where it is retained and analyzed.

Microsoft.​Security/​workspaceSettings/​delete

Deleting the workspace settings stops export of Defender security data to Log Analytics, cutting off telemetry retention and analysis.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links