services / Azure / Microsoft Sentinel onboarding state

The onboarding state marking a Log Analytics workspace as enabled for Microsoft Sentinel, gating whether the SIEM is active for that workspace.

The onboarding state controls whether Sentinel runs on a workspace at all; removing it offboards the SIEM, so the resource type is HIGH.

Microsoft.​SecurityInsights/​onboardingStates/​delete

Deleting the onboarding state offboards Sentinel from the workspace, tearing down detections and halting security-telemetry aggregation for it.

Risks

1. Defense destruction (EVASION)
2. Logs destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links