services / Azure / Microsoft Sentinel confidential watchlists

Confidential Watchlists are sensitive curated reference data sets in Microsoft Sentinel (e.g. VIP users, terminated employees, sensitive assets/IPs) that analytics rules correlate against during detection.

Explicitly marked confidential; contents are sensitive security operations data, so the asset is HIGH sensitivity.

Microsoft.​SecurityInsights/​ConfidentialWatchlists/​delete

Deleting Confidential Watchlists destroys sensitive curated data and removes the lookup tables that detection rules depend on, weakening defensive coverage.

Risks

1. Data destruction (CRITICAL)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links