services / Azure / Microsoft Sentinel source control connection

A Microsoft Sentinel source-control connection binding the workspace to a Git repository (GitHub/Azure DevOps) for content CI/CD, holding the repository connection and credentials that deploy detections and content.

Source-control connections carry repository credentials and an automated content-deployment path into the workspace, a persistence and content-tampering vector, so the resource type is HIGH.

Microsoft.​SecurityInsights/​SourceControls/​delete

Deleting a source-control connection tears down the managed content pipeline that keeps detections deployed and updated, degrading detection maintenance.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links